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SECTION I 
INTRODUCTION 


In the past, fixed thrust rocket engines have been generally controlled in 
a straight-forward manner, employing time-sequenced valves for control of 
the engine start and shutdown transients, and trimmable orifices for control of 
steady-state set points. Operational checks generally included pre flight engine 
firing and component tests and required considerable ground support equip- 
ment. Monitoring sensors were added to the engine for flight performance 
assessment. 

The advent of the Space Shuttle engine with its requirements for high 
specific impulse, long life, and low cost have dictated a staged combustion 
cycle and a closed loop control system to allow the engine components to run 
close to operating limits. These performance requirements, combined with 
the necessity for low operational costs, have placed new demands on rocket 
engine control, system checkout, and diagnosis technology. 

Based on considerations of precision, environment, and compatibility 
with vehicle interface commands, an electronic control makes available many 
functions that logically provide the information required for engine system 
checkout and diagnosis. 

A. LOGIC MODE 

The logic mode for the SSME control consists of a basic open loop 
scheduled system, with supervisory trim for precision and overrides for 
failure protection. The basic open loop system runs the engine through its 
normal operating range with an absolute minimum dependence on measure- 
ments. The propellant modulating elements of the engine are moved in re- 
sponse to vehicle requests in accordance wi h a predetermined schedule of 
effective flow area as a function of the requt 5ted power or mixture ratio. 
Dynamic compensation is accomplished in this system by directly relating 
flow area change with time (rate control). Information to establish. these 
schedules and rate limits is obtained from prior analysis and confirmed by 
engine and valve test data. The schedules are stoied in the digital control 
permanent memory. 

A secondary mode of control is the supervisory, or limited authority, 
trim function that employs some process measurements fcr its operation. This 
mode improves thrust and mixture ratio precision by sensing engine chamber 
pressure and flow ratio and trimming the basic control to within the allowable 
error limits. 

B. ENGINE LIMITS 

The staged combustion cycle has several critical performance parameters 
that must be controlled to obtain the desired specific impulse with a minimum 
engine weight. Each of these parameters has an established limit that must not 
be exceeded. Repeated minor violations of these limits can reduce engine life; 
major violations of these limits, even for short time periods as in an engine 
transient, can produce component failures. 


The critical engine performance parameters include turbine inlet temp- 
erature, main chamber wall temperature, turbopump speed, and turbopump 
NPSH mar, gin. If the engine is designed for wide margins between the oper- 
ational boundaries and the established physical limits, this will result in 
additional weight for a given engine performance. Efficient engine design, 
therefore, dictates that the engine operate close to the performance parameter 
limits: 

While the primary function of the control system is to control the engine 
during steady-state and transient operation, an important secondary function 
is to protect the engine against the effects of deterioration of any component 
part of the engine or control system. Critical engine parameters must be 
monitored to keep the engine within its design operating limits even though an 
unanticipated environmental change or a component malfunction has changed 
the basic engine characteristics so that the predetermined schedules are no 
longer valid. A limit override system senses the critical engine parameters 
an d functions only when an established limit has been reached. Analytical 
substantiation that these limits can be met is provided with this design report. 
Hardware design verification may require change in the limits, and adjustment 
capability is provided. 

C. ENGINE ON-BOARD CHECKOUT 

Automated on-board checkout and recording systems minimize the need 
for ground support equipment and their associated maintenance and reliability 
problems. An operational readiness signal will indicate that the engine can 
start and accelerate to any thrust level. The engine inlet conditions will be 
^measured and compared to limits stored in the control. 

The engine operational readiness checks will include self test of the 
-control. If all systems are within the limits, a signal will be provided to the 
.vehicle. If any parameter is out of limits, it will be identified to the vehicle. 

L* "L The sensors and control logic required for engine control and protection 
■ also provide all of the information which must be monitored for engine per- 
; fonnanc8 assessment, checkout, diagnosis, and malfunction isolation. 

-J-- Because it is not feasible to hot fire the engine for ground checks, inflight 
data recording and subsequent analysis of available parameters is most impor- 
tant to expedite the maintenance turnaround. Interrogation a id multiplexing 
-procedures for the monitored parameters must be coordinate 4 with the vehicle 
■to assure that adequate vehicle data recording capacity is available and that 
fault indications are properly assessed by the vehicle for corrective action. 

Engine monitoring during preflight and flight operation can provide the 
data necessity to identify failed line -re place able units and schedule maintenance 
activity. 

D. CONFIGURATION 

p - - • The level of complexity of the control and checkout task requires the use 
of a digital electronic computer. Pratt & Whitney Aircraft is currently applying 
engine -mounted electronic controls to gas turbine engines under development; 
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many thousands of hours of operational experience will be accumulated in 
these programs. Solutions to the environmental problems obtained in these 
programs are available to supplement the SSME control development. Environ- 
mental conditioning can be accomplished for electronic controls and the de- 
sired computation precision can be attained. The electronic control interfaces 
readily with the vehicle and when engine-mounted, connects easily with remotely 
located valve actuators and sensors. Considerations for system precision, 
compatibility with vehicle interface commands, and data requirements for 
engine diagnosis dictate an electronic engine command unit for the SSME. 
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SECTION II 

CONTROL SYSTEM LOGIC 


A. INTRODUCTION 

The primary control task is to meter propellants to the combustion 
system: The relationships between flow rates and generated thrust is thermo- 
dynamically predictable. The relationships between flow rates and corre- 
sponding metering valve area can be closely determined through analytical and 
model evaluation. Therefore, it is possible to generate a control mode that 
provides approximately the right valve areas as a function of requested thrust 
which are not dependent on closed loop correction from sensor measurements. 
This is the selected approach and will be referred to as a basic open loop mode. 

It guides the process in response to requested thrust and mixture ratio changes, 
provides a backup mode that can continue to provide acceptable control in the 
event sensor measurements fail, and also provides a model for simulated ground 
checkout without process simulation. 

The SSME engine is a basically stable process. Fixed thrust engines such 
as the RL10 will produce a stable thrust with fixed valve areas. Because a 
closed loop control mode is not required for stability, as it is in most flight 
trajectory control systems, the configuration of the closed loop can be arranges 
in mauy ways to achieve precision, tolerance to engine component degradation, 
reduced sensitivity to changing inlet conditions, and favorable failure responses. 
In an effort to find the arrangement that accommodates these variations, con- 
tinuing trade studies are being made. This volume represents a description 
and substantiation of the basic control mode. A further refinement of the closed 
loop portion is described in PWA FR-4249, Volume I, Section II, and differs 
slightly from the closed loops defined in this volume. Closed loop control of the 
turbopump speed has been eliminated to avoid a failure mode associated with 
loss of this sensed parameter and to improve tolerance to changing inlet con- 
ditions. The flexibility of the digital ECU allows these software changes to 
be made quickly, with no impact on the control hardware requirements. The 
selected control approach remains a basic open loop mode for stable, responsive 
control, which is supplemented with limited authority Integrating closed loops for 
precision, and limit measurements for engine protection (figure II-l). 

B. CONTROL DESIGN STRESSES PRACTICAL APPROACH TO 

ENGINE CONTROL 

1. Control System Meets Requirements 

Simulation studies at Bendix and Pratt & Whitney Aircraft demonstrate 
that the engine and control system safely accelerates, decelerates, and meets 
stability requirements in response to thrust level and mixture ratio commands. 

Three different levels of control are combined to form the structure of 
the complete working control system for the engine: 

1. Open-loop scheduling 



. 'V- 


2. Closed-loop trimming 

3. Protection-loop limiting. 
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Figure n-1. SSME Control System ,FD 52630 

Open-loop scheduling does the basic, coarse positioning of the fdur con- 
trol valves and is the framework for the entire control. Closed loops trim the 
open-loop valve positions on the basis of feedback information to accurately 
meet thrust and mixture ratio commands. Protection loops are constantly 
monitoring critical engine parameters for engine safety. For normal engine 
operation, no protective action is required so the loops have no effect on the 
final closed-loop trimmed valve positions. 

. — C. 

This control design has evolved from the XLR129 rocket engine program. 
The flexibility inherent at the leve’. of open-loop schedules makes this control 
concept easily adaptable to future changes in engine sizing, performance, and 
requirements. . - 

2. Open-Loop Scheduling Provides Many Advantages 




The open-loop mode, alone, runs the engine by scheduling all of the 
control valves along their steady-state position schedules. No engine process 
feedback information is used. Thrust and mixture ratio command signals are 
filtered through velocity limiting servos before being sent to the steady-state 
control valve position schedules. The filtering ensures a smooth, coordinated 
change of valve positions at a known velocity. During accelerations, the re- 
quested mixture ratio command is overridden and the engine moves along a 
known path, mixture ratio of 6. 0, away from limits. At the end of the acceler- 
ation, the engine returns to the requested mixture ratio. Using open-loop 
scheduling, the engine can rapidly decelerate, change mixture ratio, and, 
unlike past engine cycles , rapidly accelerate without special compensation. 

The major features unique to the open-loop scheduling are coordination 
of valve movement, capability to monitor system health, and independence 
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from process sensors. The coordinated movement of all the valves by the 
open-loop mode is the key to moving the engine safely from one requested 
running point to another. The design of the closed loops and protection loops 
complements this effect. Having steady-state schedules in the control gives 
a reference with which to check the closed-loop trim values for indications of 
engine condition and control loop performance. If a closed loop is detected as 
having failed, the loop is opened, and, depending on the loop’s place in the 
hierarchy of the closed loops, the engine can be run with the open-loop mode 
and some of the remaining loops closed or with the open-loop mode alone. 

3. Closed Loops and Scheduling Make a Practical Control 

Closed loops are a practical necessity to trim the open-lo p scheduled 
valve positions for accuracy, to smooth external disturbances, and to extend 
engine performance beyond the conditions where the basic schedules were 
determined. The open-loop schedules perform the major positioning of the 
control valves. 

Four closed loops are added to the basic open-loop mode to cont rol 
thrust, mixture ratio, fuel pump speed, and cooling flow. The thrust and 
mixture ratio loops are used to ensure accuracy with the commanded values. 

Fuel pump speed is controlled by a closed loop to regulate high pressure 
turbopump power conditions existing internal to the engine. Cooling flow 
closed-loop maintains adequate transpiration cooling flow without overcooling. 

4. - Protection Loops Ensure Safe Engine Operation 

Eleven protection loops, which continuously monitor critical engine 
parameters not controlled by closed loops, are added to the full-time control 
system. The parameters limited by these loops are maximum preburner 
temperature, minimum high pressure curbopump net positive suction pressure 
{NPSP) margins, all turbopump overspeeds, and maximum vibration in all 
turbopumps. Each parameter is continually compared with its limiting refer- 
ence value and, if protective action is necessary, the loop resets the velocity 
limited thrust and mixture signals sent to the control schedules until cue para- 
meter is returned to a safe region. Normally, no action is necessary; hence, 
the protective loops have no effect on the closed-loop trimmed valve positions. 

5. Start and Shutdown is Time Sequenced 

- Prestart, the initiation of start and completion of shutdown from 20% 
thrust are treated as a separate problem irom controlling the engine in its 
operating range. These. transients are time sequenced, open-loop scheduled 
with permissive signals fed back for limiting; go, no-go purposes only. During 
these short time intervals, the full-time closed loops and protection loops are 
opened and the trim integrators zeroed. The thrust velocity servo incorporates 
the logic for start or shutdown and provides a time base for sequencing all 
valves and solenoids. The four control valves are scheduled using an extension 
of their normal steady-stage schedules into thrust levels below control takeover. 

C. CHAMBER PRESSURE CLOSED LOOP ACCURATELY CONTROLS THRUST 

o. The requirement for precise thrust control dictates an integral closed 
oop on thrust. The thrust closed loop integrally trims main chamber LOX 


flow to hold thrust at the commanded value. The thrust loop trim moves the 
_ preburner and main chamber oxidizer valves simultaneously so that main 
. _ cumber LOX flow is changed while power available to the pumps is minimally 
affected (figure n-2). This action results in thrust trimming with little upset 
of the other closed loops in the control system. 


« chamber pressure reference is scheduled (Gl) as a function of velocity 

limited thrust and mixture ratio signals. The reference is compared with 
sensed main chamber pressure to form an error signal. This error acts 
through a lead-lag network and an integrator with limited authority to generate 
the trim signal, PCTRIM. (Actually, the error acts first through a nonlinear 
gain schedule and then the lead-lag in order to reduce noise level in the signal 
®5 b r ® PCTRIM trims directly on the scheduled main chamber valve angle, 

02R to change the main chamber LOX flow and, therefore, thrust PCTRIM ** 
snnuitaneousiy trims the preburner LOX valve travel through a gain, GPCPB 

maS\h?mbefprSJe1evel! labIe 10 016 hlgh ? ressure ^rbopumps at the new 


•'The velocity limited thrust signal to the main chamber pressure reference 
~ -schedule is lagged by a time constant, TPCSD. This allows the reference 
— for the thrust trim loop to lag behind the rest of the control schedules during 
a commanded thrust change by an amount comparable to the main pump dynamic 
- “*£* W^h the reference lagged, the thrust trim loop drives thrust only as 
'- v ' * as * as th e pumps are accelerated. In conjunction with a similar lag in the fuel 
pump speed loop reference, this minimizes the dynamic mismatch of the pumps 
“ and keeps the system moving in a coordinated manner set by the ooen-looo 
schedules. * ^ 

During a thrust change (acce’eration or deceleration) the ACBLAS signal 
svc changes PCTRIM through a gain, CACMCV. This reset provides most of the 
m necess f r y during the transient, and therefore prevents the iiuegral loop 
. *rom trimming far out of position during transients. 

TUT ? V..:?'- v t 

er.v^'. --if for some reason, such as iriet conditions and/or component degradations, 

thrust trim necessary to hold thrust approaches the maximum authority of 

r* “ •™ e integrator, PCTRIM will also increase the high pressure fuel turbopump 
®r e ed reference through G4 and GPCSNF. As the actual speed is increased 
by the speed loop, more power is supplied to the pumps and pump output 
r pressure increases , which results in more LOX flow into the main chamber 
and higher thrust. By this method, the thrust loop controls thrust by varying 
the main chamber valve and holding pump power constant normally, or varying 
rr-pump power to get the flow change necessary in extreme situations. 


- •_ D. CLOSED LOOP TRIM OF VEHICLE MIXTURE RATIO 

Accurate oxidizer to fuel flow ratio balance must be maintained at steady 

- state for proper propellant management. During a transient it is desirable to 
control mixture ratio to a mid OFV range, thus avoiding engine limits peculiar 

..to extreme mixture ratio values. 
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The mixture ratio reference value is set by a rate limited servo receiving the 
mixture ratio command, or during an acceleration, the constant acceleration 
bias value, OFACEL (figure II— 3) . The actual mixture ratio is computed by 
dividing total measured oxidizer flow with total measured fuel flow. The 
reference mixture ratio is compared with engine computed mixture ratio 
to generate an error signal. This error signal acts through a dynamically 
compensated integrator to form a mixture ratio trim signal vsed to correct 
fuel flow and obtain the desired mixture ratio. 

Trimming the fuel pump speed in conjunction with fuel valve area ensures 
that adequate pressure drop across the valve is maintained for control. The 
fuel-valve pressure drop is affected by fuel inlet pressure and temperature 
and fuel side component variations or changes such as pump efficiency. 

Moving the fuel valve with coordinated fuel pump speed adjustment utilizes the 
built-in valve capability for correcting mixture ratio. As a result, the 
required fuel pump speed or turbine power is minimized at steady-state 
conditions. 

Integrator authority limits are provided in the trim loop to prevent 
excessive fuel valve excursions and pump speed adjustments. During start 
and shutdown cycles , the mixture ratio trim is opened and the integrator 
zeroed. 

E. INTEGRAL LOOP CONTROLS PUMP SPEED 

A reference fuel pump speed is scheduled steady-state (HI) as a function 
of velocity limited thrust and mixture ratio signals and is compared with the 
actual sensed speed to form an error. This error acts through a lead-lag net- 
work and an integrator to trim the scheduled preburner oxidizer valve travel, 
X4R (figure II-4). 

In addition, the velocity limited thrust signal is lagged to the speed 
reference schedule by a time constant, TFPSD. Thus the referenoi value 
lags behind the rest of the control schedules during a thrust transient by an 
amount chosen to be comparable to the normal pump lag. This prevents 
overdriving the pump during the initial portion of an acceleration which would 
cause unnecessary disturbances for the mixture ratio closed loop. 

During commanded thrust transients, the ACBIAS signal acts directly to 
change the scheduled preburner LOX valve position, thereby reducing excessive 
transient trimming required of the speed loop which would cause the integral 
loop to move away from its steady-state trim value. At the end of the transien' , 
the ACBIAS signal is removed and the integral loop has to move only a small 
amount to its new steady-state trim value. 

The thrust and mixture ratio loops shift the scheduled speed reference value 
so that pump power is adjusted to support the trim action of these loops during 
extreme changes in inlet conditions and component degradations. Thrust 
trim, which acts on the main chamber and preburner oxidizer valves, will 
increase the speed reference through GPCSNF when PCTRIM approaches its 
maximum limit. The mixture ratio loop trim, which changes fuel valve 
position, acts to change the reference speed on a percentage basis through 
GOFSNF. 
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Figure H-3. Mixture Ratio Trim Loop 
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Figure n-4. Fuel Pump Speed Trim Loop 
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F. TRANSPIRATION COOLANT FLOW CONTROL PROVIDED 

4 

1. Main Chamber Cooling is Vital 

The wall of the main chamber must be cooled to prevent overheating by the 
hot combustion gases. Cooling flow is supplied to the main chamber through 
the transpiration cooling circuit which contains a fixed area restriction in 
parallel with a variable area restriction. The cooling flow is supplied by the 
total pressure drop from the output pressure of the fuel pump to the main 
chamber pressure. 

2. Cooling Flow Loop Closed on Transpiration Manifold Supply Pressure 

The required transpiration cooling flow is strongly affected by and 
increases nearly linearly with the thrust level or chamber pressure of the 
engine and total engine mixture ratio. For these reasons transpiration, 
manifold supply pressure is scheduled as a function of actual chamber pressure 
and mixture ratio (figure II -5). The scheduled pressure is compared with 
actual manifold pressure to form an error signal. The error signal is 
conditioned first through a nonlinear gain schedule and then a lead-lag 
network, to reduce the noise level in the signal. The compensated error acts 
integrally to adjust the cooling valve to maintain proper cooling flow margin. 
Integrator authority limits are provided in the trim loop to prevent excessive 
coolant valve excursions. During start and shutdown cycles, the coolan f loop 
is opened and the integrator zeroed. 

3. Acceleration Transient is a Special Problem 

The slower fuel turbopump reduces coolant flow during an acceleration 
and causes additional cooling during a deceleration. The amount of cooling 
flow change from steady-state caused by the engine transients also varies with 
thrust level. Therefore a scheduled reset further opens the coolant valve 
during an acceleration transient to insure that adequate cooling flow is 
maintained. The reset on the closed loop reference pressure prevents the 
integrator from trimming out the imposed reset on the coolant valve. 

G. PROTECTION LOOPS OVERRIDE THRUST SERVO 

1. Safe Engine Operation is Assured by Protection Loops 

Protection loops are necessary to keep critical engine parameters away 
from operating limits. During normal engine operation, no protective action 
is required, but if the engine is requested to operate at a point where an 
unsafe condition exists, the protection loops override the requested thrust 
level velocity and slow or reverse the velocity limited thrust signal to the 
schedules. If the unsafe condition forces requested thrust to 50% and still 
exists the engine will normally be shut down. 

2. All Protection Loops Correct in Same Manner 

The protection loops limit eleven different engine parameters: preburner 
temperature , NPSP of the high pressure pumps (2) , all pump speeds (4) , and 
vibration in all pumps (9). 
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All of these loops compare a limiting reference value with a sensed 
variable to generate an error signal. When the error multiplied by a propor- 
tional gain drops below a minimum value (AVPRO) , it overrides the thrust 
servo velocity signal. In addition, the preburner overtemperature loop error 
also lowers the velocity limited mixture ratio signal to further improve the 
temperature margin. 

3. Trimming Thrust Provides Protective Action 

The loop with the lowest protective signal is selected out of the eleven 
signals for thrust servo logic switching and protective action (figure n-6). 

When this selected signal drops below both the threshold level, AVPRO, and 
the servo velocity signal, TLRV, the servo is switched from TLRV to the 
dynamically compensated velocity requested by the protective loop. The 
protection loop thus slows the servo allowing the pumps to rebalance relative 
to each other, and, if necessary, reverse the thrust servo and settle out at a 
lower thrust level. While the protection loop is in control of the servo, the 
transient resets are active in the safe direction through the ACBIAS signal. 

The thrust servo is restored to the commanded value when the protection 
signal increases above the threshold level, or when the command requests a 
lower thrust level than the protection loop. The protection loops can be 
overridden by an abort override signal from the vehicle which removes the 
protection value and gives full authority to the commanded value. 


H. PROTECTION LOOPS CONTINUALLY MONITOR PUMPS 

I. Net Positive Suction Pressure, Speed, Vibration are Limited for Engine 

Safety. 

Two protection loops monitor the high pressure oxidizer and fuel 
turbopumps 1 net positive suction pressure (NPSP) margins to prevent the 
flow unbalance, and the resulting upset in thrust and mixture ratio caur ed 
by cavitation in the pumps (figure II— 7) . All four pump speeds are checked 
by protection loops to prevent a pump speed from exceeding its maximum 
speed limit. The vibration of each turbopump is also monitored by four 
protection loops so vibration will not exceed a maximum limit. These protec- 
tive loops are active only when correction is necessary, and slow or reverse 
the thrust servo until a safe operating condition exist?. 

2. Cavitation Prevented by Slowing Acceleration 

For both the oxidizer and fuel high pressure turbopumps, a reference 
NPSP is scheduled as a function of pump speed, flow and fluid density. The 
fluid density is computed from fluid temperature and pressure at the pump 
inlet. Actual NPSP is the difference between the high pressure pump inlet 
pressure and the saturation pressure of the fluid, which is computed as a 
function of pump inlet temperature. The reference NPSP signal is subtracted 
from the actual NPSP to generate an error. The error multiplied by a gain 
is the uncompensated thrust servo projection velocity requested by the NPSP 
loop. Slowing the thrust servo allow.- the low pressure and high pressure 
turbopumps to rebalance relative to each other and will normally be enough 
to restore NPSP margin. 
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Figure II- 6. Thrust Trimming Loop 
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3. Protected Turbopump Speed Held at Limit 

All four pump speeds are limited in the s^me manner. A pump speed is 
sensed and compared with its constant maxim am value to form an error. The 
error multiplied by a gain is the thrust servo protective velocity requested 
by that speed loop. Should overspeed protective action be required, the pump 
can settle out a speed equal to the maximum v Llue. 

4. Vibration Limits Ensure Safe Pump Operation 

All turbopumps are limited at a maximum vibration level in a manner 
similar to overspeed correction. Pump vibration is sensed and compared 
with a maximum vibration level to form an error signal. The error multiplied 
by a gain is the thrust servo protective velocity requested by that vibration 
loop. When the vibration loop is active, the engine will run at a thrust 
level where the vibration is at the maximum safe value. 

I. PREBURNER TEMPERATURE IS LIMITED BY CLOSED LOOP 

1. Temperature Controlled Through Preburner Mixture Ratio 

The preburner temperature protection loop assures safe engine operation 
by acting to limit the temperature of the high pressure turbines at a safe, 
maximum operating value. The preburner temperature or turbine inlet 
temperature is directly influenced by preburner mixture ratio. If correction 
is required, the preburner temperature protection loop will act to reduce 
the preburner mixture ratio and, therefore, preburner temperature by 
decreasing the velocity limited mixture ratio signal and by slowing or reducing 
the velocity limited thrust signal. 

2. Simultaneous Action Limits Temperature 

Preburner temperature is indirectly sensed by four sensors located at the 
exit of each high pressure turbine ( 'igure H-8). The high median or second 
highest sensed temperature is selected as the feedback temperature to compare 
with the maximum reference. The feedback temperature is subtracted from 
the maximum reference to form an error. When this error drops below a 
minimum value, OFP, it acts to reduce mixture ratio through a gain, GTPBOF. 
Mixture ratio correction is limited at a maximum amount, OFPMIN. The 
error also slows the thrust servo velocity through a gain, GTPBTL, in the 
same manne as the other ten protection loops. 

Both actions of the error signal limit the temperature to the safe , maximum 
value. Shifting mixture ratio results in more fuel flow relative to oxidizer 
flow and a lower preburner temperature. Slowing thrust level change allows 
the slower high pressure fuel turbopump to catch the other turbopumps and 
thus bring fuel flow back into line with the oxidizer flow. If the problem is 
more than a transient mismatch of turbopumos, the system can safely settle 
out at the maximum temperature with thrust lower than requested and mixture 
ratio between the requested value and the open-loop acceleration mixture ratio. 
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4. Number of Schedules is Minimized 

The number of start and shutdown schedules is minimized by extending 
and utilizing the schedules of the four control valves needed in the basic control 
system. They are the preburner oxidizer valve, main chamber oxidizer valve, 
transpiration cooling valve, and preburner fuel valve. A positive velocity 
servo error drives the four valves to the start schedule and a negative error 
drives the valves to the shutdown schedules by changing the mixture ratio used 
in computing the valve schedules. 


K. ENGINE PROTECTED AGAINST IMPROPER START AND SHUTDOWN 


1. Main Chamber Pressure Checked After Start Sequence 


After the engine has gone through start sequence, the main chamber 
pressure is checked at low thrust levels. If the sensed chamber pressure is 
within a selected error band, the thrust servo is permitted to continue 
scheduling the engine to the commanded thrust level. If the chamber pressure 
does not fall within the error band, the thrust servo is held at a selected level 
for a short time to allow the chamber pressure to correct itself. The servo 
is requested to shut the engine down by opening the switch supplying the com- 
manded signal if the chamber pressure error is not met in the time ailoted 
(figure II- 10). 



Proper Engine Shutdown Assured 


' When the engine is decelerated into shutdown, the main chamber is again 
checked before going into the shutdown sequence. The servo is held only if P c 
id too far from the scheduled value. After the proper pressure is obtained, 
the normal shutdown sequence occurs. Proper valve pressure drops to P c are 
now ensured for proper shutdown. 


L._ CONTROL SYSTEM BLOCK DIAGRAMS 

The SSME Control System block diagrams are presented in figures 11-11 
through H-14. Tables II-l through II-3 contain a glossary of terminology shown 
on each block diagram. — - — 
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Table II— 1 . Glossary of Terms for Figure 11-12 (Continued) 


Name 

Description 

Val«** 

Units 


Protection Loop Logic 



AVPRO . 

Protection threshold switching 
velocity 

10.0 

%/sec 

TLPRSD 

Protection loop shutdown indication 

-1.0 

%/sec 

TPRON 

Lead dynamic compensation 

0.125 

sec 

TPROD 

Lag Dynamic compensation 

0.0125 

sec 


Start and Shutdown Protection 



TLST 

Start hold thrust level 

20.0 

% 

TLSD 

Shutdown hold thrust level 

21.0 

% 

PEMN 

Minimum tolerable main chamber 
pressure error at hold level 

TBD 

psi 

PEMX 

Maximum tolerable main chamber 
pressure error at hold level 

TBD 

psi 

TSTSD 

Hold time 

TBD 

sec 

Table II -2. Glossary of Terms for Figure 11-13 


Basic Valve Schedules and Full-Time Closed Loops 


Name 

Description 

Value 

Units 


Preburner Fuel Valve 


• 

A1 

Nominal valve area schedule (booster) 

APBFV 

In. 2 

A2 

Valve position schedule 

03R 

deg 

A3 

Nominal valve area schedule (orbiter 

APBFV 

in. 2 

GACPFV 

Acceleration reset on valve position 

5.0 

deg 


Transpiration Coolant Valve 



B1 

Nominal valve area schedule 

ATRV 

in . 2 

B2 

Valve position schedule (linear, 
with a gain of 0.73 in. “/in.) 

X1R 

in. 
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Table n-2. Glossary of Terms for Figure 11-13 (Continued) 


Name 

Description 

Value 

Units 

B3 

Acceleration reset on valve position 
(linear; 40% reset at 20% thrust to 

GACWC 

unitless 

* 

20% reset at 100% thrust) 




Main Chamber Oxidizer Valve 

• 


Cl 

Nominal valve area schedule 

AOMCV 

in. 2 

C2 

Valve position schedule 

02 R 

deg 


Preburner Oxidizer Valve 

• 


D1 

Nominal valve area schedule 

APBOV 

O 

in. * 

D2 

Valve position schedule 

X4R 

in. 

GACPBO 

Acceleration reset on valve position 

0.02 

in. 


Mixture Ratio Trim Closed Loop 



El 

Integrator velocity schedule (de- 

OFSUM 

deg/sec 


fined by GOF, VOFMX, VOFMN) 



-GOF 

Integrator velocity gain 

20.0 

deg/sec 

VDFMX 

Maximum positive integrator 

45.0 

ratio 

deg/sec 


_ velocity limit 


VOFMN 

Maximum negative integrator 
wlfMM'tv limit 

-45.0 

deg/sec 



. 


TOFN 

Dynamic compensation lead time 

0.1 

sec 


constant - 

• 


TOFD - 

. Dynamic compensation lag time 

0.01 

sec 


constant 



OFSMAX 

Maximum positive integrator 

10.0 

deg 


trim authority 



OFSMIN 

Maximum negative integrator 
— trim authority • 

-9.0 

deg 

GOFSNF 

Percentage reset on speed reference 

0. 0033 

_1_ 

deg 


\ 


11-26 


Pratt & Whitney Aircraft 


PWA FR-4249 
V r olume II 


Table II-2. Glossary of Terms for Figure 11-13 (Continued) 


G3 


Integrator velocity schedule (defined 
by GPC, VPCMAX, VPCMIN) 

11-27:., 


Namf 

Description 

Value 

Units 


Transpiration Coolant Flow Trim 
• Closed Loop 



FI 

Transpiration manifold pressure 
reference schedule 

PTRWAR 

psia 

GACPTR 

Acceleration reset on reference 
pressure 

0.035 

unitless 

F2 

Integrator velocity schedule 
(defined by GPTR, VPTRMX, 
VPTRMN) 

PTRWE 

in. /sec 

GPTR 

Integrator velocity gain 

0.001 

in. /sec 
psi 

VPTRMX 

Maximum positive integrator 
velocity limit 

0.20 

in. /sec 

VPTRMN 

Maximum negative integrator 
velocity limit 

-0.20 

in. /'sec 

TPTRN 

Dynamic compensation lead time 
constant . _ 

0.10 

sec 

TPTRD 

Dynamic compensation lag time 
constant r _ 

0.01 

sec 

PTRMAX 

Maximum positive integrator trim 
authority ’ •: r* 

0.10 

in. ORIGINAL 
OF POOR i 

PTRMIN 

Maximum negative integrator trim 
authority 

-0.03 

in. 


Thrust Trim Closed Loop 



TPCSD 

Thrust level lag time constant to 
reference schedules 

0.125 

sec 

G1 

Main chamber pressure reference 
schedule (booster) 

PCREF 

psia 

G2 

Total propellant flow backup 
reference schedule 

WTOTR 

lb /sec 
m 

GWTPC 

Closed-loop gain conversion factor 

2.88 

psi 

tt> /sec 

m 


deg/sec 


Table II-2. Glossary of Terms for Figure 11-13 (Continued) 



— 



Name 

Description 

Value 

Units 

GPC 

* 

Integrator velocity gain 

0.02 

deg/sec 

psi 

VPCMAX 

Maximum positive integrator 
velocity 

10.0 

deg/sec 

VPCMIN 

Maximum negative integrator 
velocity 

-10.0 

deg/sec 

•TPCN 

Dynamic compensation lead time 
constant 

0.1 

sec 

TPCD 

Dynamic compensation lag time 
constant 

0.01 

sec 

PCMAX 

Maximum positive integrator trim 
authority 

10.0 

deg 

PCMIN 

Maximum negative integrator trim 
authority gain 

-10.0 

in. /deg 

GPCPB 

Coordinated preburner oxidizer 
valve gain 

0.024 

in. /deg 

G4 

: Hirust trim "bump” gain schedule 
(zero below (PCMAX - 2.0) deg, 
linear beyond) 


deg/deg 

GPOSNF 

Thrust trim reset on speed reference 

1000 

rpm/deg 

GACMCV 

Acceleration reset or thrust trim 

2.0 

deg 

7 Gf> 

Main chamber pressure reference 
schedule (orbiter) 

PCREF 

psia 


High Pressure Fuel Turbopump 
Speed Trim Closed Loop 



TFPSO 

Thrust level lag time constant to 
speed reference schedule 

0.125 

sec 

HI 

Fuel high pressure turbopump 
reference schedule 

SNFRE 

rpm 

H2 

Integrator velocity schedule 
(defined by GSNFP, VSNMX, 

SNFPE 

in. /sec 


- VSNMN) - 


- - - 

GSNFP 

Integrator velocity gain 

0.00005 

in. /sec 


inter-* - - ". .. . <n^ rpm 
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Table II-2. Glossary of Terms for Figure 11-13 (Continued) 


Name 

Description 

Value 

Units 

VSNMX 

Maximum positive integrator 
velocity 

0.206 

in. /sec 

VSNMN 

Maximum negative integrator 
velocity 

-0.413 

in. /sec 

TFPN 

Dynamic compensation lead time 
constant 

0.1 

sec 

TFPD 

Dynamic compensation lag time 
constant 

0.01 

sec 

SNMAX 

Maximum positive integrator 
trim authority 

0.0258 

in. 

SNMIN 

Maximum negative integrator 
trim authority 

-0.0258 

in. 


Propellant Flowmeters 



11 

Oxidizer density schedule 

ROIES 

lb /in. 3 
m 

GLMET 

Oxidizer flowmeter constant 

0.00167 

/ 5\ 1/2 

/ lb m in \ 

l sec 2 lbj J 

12 

Fuel density schedule 

RFIES 

lb /in. 3 
m 

GFMET 

Fuel flowmeter constant 

0.0014 

/ 5X 1 / 2 

/ lb m \ 

^sec 2 Ibj J 

Table II— 3 . Glossary of Terms for Figure 111-14 

Name 

Description 

Value 

Units 

Al 

High Pressure Fuel Turbopump 
NPSP Protection Loop 

Required NPSH reference schedule 


in. lbf 


lb rpm 2 
m 

A2 

Fuel density schedule 

RFPn 

lb /in. 3 
m 
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Table .11-3 . Glossary of Terms for Figure III-14 (Continued) 


Name 

Description 

Value 

Units 

A3 

Fuel vaporization pressure schedule 

PSATFS 

psia 

gspfp 

Protection gain 

0.008 

%/sec 

psi 


High Pressure Oxidizer Turbo- 
pump NPSP Protection Loop 




Required NPSH reference schedule 


in. lbf 

B1 


2 

tt> rp:n 
m 

B2 

Oxidizer density schedule 

ROPn 

lb /in. 3 
m 

B3 

GSPOP 

Oxidizer vaporization pressure 
schedule 

Protection gain 

PSATOS 

psia 

%/sec 

psi 


Prebumer Overtemperature 
Protection Loup 



TPBTN 

Dynamic compensation lead time 
constant 1 

Matched 

to 

8'iC 

TPBTD 

Dynamic compensation lag time ' 
constant 

Sensor 

sec 

TPBREF 

Maximum high pressure turbine 
exit temperature limit 

2075. 0 

. °R 

GTPBOF 

Protection gain to mixture ratio 

0.0 

ratio/* R 

%/sec 

*R 

GTPBTL 

Protection gain to thrust velocity 

0.117 

OFP 

Protection value where mixture 
ratio correction begins 

0.0 

ratio 

OFPMIN 

Maximum negative mixture 
ratio correction 

-0.5 

ratio 

DVMAX 

Maximum thrust servo deceleration 
velocity (refer to Table II-l, Thrust 
Velocity Servo) 

80.0 

%/sec 
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Name 


Description 


Value 


Units 


High Pressure Fuel Turbop ump 
Overspeed Protection Lo op 

SNFMAX Maximum high pressure fuel turbo- 38750.0 

pump speed limit 

GPSNF Protection gain 0.004 * 


SNOMAX 

GSNOP 


High Pres s ure Oxidizer T urbopump 
Overspeed Protection Loop 

Maximum high pressure turbopump 18824.0 
speed 


Protection gain 0. 008 


SNFIMX 

GSNFI 


-SNOIMX 

GSNOI 


Low Pressure F uel Turbopump 
Overspeed Protection Loop 

Maximum low pressure fuel turbo- 112G8.0 

pump speed 

Protection gain 0.016 

Low Pressure Oxidize Turbopumo 
Overspeed Protection Loop 

Maximum lov/ pressure oxidizer 3497.0 

turbopump speed 

Protection gain * 0. 044 


"VSNFIM 


GVSNFI 


_ Low Pressure Fuel Turbopump 
Vibration Protection Loop 

Maximum low pressure fuel turbo- 
pump vibration 

Protection gain 


* 


* 


Low Pressure Oxidizer T urbo - 
' pump Vibration Protection Loop 

VSNOIM Maximum low pressure oxidizer * 

turbopump vibration 


rpm 

%/sec 

rpm 


rpm 

%/sec 

rpm 




%/sec 

rpm 


rpm 


%/t.ec 

rpm~ 


g 

%/sec 

g 


g 
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Table III— 3. Glossary of Terms for Figure III— 14 (Continued) 


Name 

Description 

Value 

Units 

GVSNOI 

Protection gain 

* 

%/sec 

g 

„ • 

High Pressure Fuel Turbopump 
Vibration Protection Loop 



VSNFM 

Maximum high pressure fuel 
turbopump vibration 

* 

. g 

GVSNF 

Protection gain 

* . 

%/sec 

g 

- - - 

High Pressure Oxidizer Turbopump 
Vibration Protection Loop 



VSNOM 

Maximum high pressure oxidizer 
turbopump vibration 

* 

g 

GVSNO 

Protection gain 

* 

%/sec 

g 

be established during engine and 
turbopump test programs. 




M'.' ' CONTROL SYSTEM REQUIREMENTS 


fcr- - CEI Specification Requirements . 

The control system meets or exceeds all applicable CEI specification 
CP2291 requirements as follows: 

1. Paragraph 3.0.1. The engine shall be capable of operating 

--T T'--. " with- a nozzle optimized for either a booster or orbiter 

application. 

Compliance - The control system contains schedules for both 
booster and orbiter engines. Upon receiving an extendible 
- - nozzle interlock signal the control selects a set of schedules 
for use with the orbiter engine, otherwise the booster engine 
schedules are used. 

2. Paragraph 3. 1.1.3. At steady-state operation, thrust must 
be held within plus or minus 10,000 lb force of the com- 
manded value. 

Compliance - Thrust is integrally trimmed to zero error 
\ > (within sensor accuracy) by driving main chamber pressure 
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to its scheduled value. The main chamber pressure sched- 
ule is calibrated to thrust to provide accuracy of the 
schedule. 

Paragraph 3. 1.2.4. At steady-state operation, mixture 
ratio must be held within plus or minus 2.0 percent of the 
commanded value. 

Compliance - Mixture ratio is integrally trimmed to zero 
error (within sensor accuracy) by driving inlet oxidizer 
to fuel flow ratio to the commanded value at any thrust 
level. 

Paragraphs 3.2. 1.2, 7.1, and 7.3. The engine shall provide 
self-contained control of its start sequence. 

Compliance - The control provides a timed base start and 
shutdown schedule sequencing of the valves and solenoids 
needed during start and shutdown. The closed loops are 
opened and zeroed during start and shutdown. 

Paragraph 3. 2. 1. 3. The engine shall be capable of acceler- 
ating from start signal to normal power level in less than 
5.0 sec. 

Compliance - Upon receiving a start signal the control 
brings the engine to 20% thrust level in approximately 
2.5 sec and accelerates the engine to Normal Power Level 
in another 1. 5 sec. 

Paragraph 3.2.2. 1. The engine shall be capable of com- * -t 

plete shutdown from any defined power level in approxi- 
mately 2.5 sec. 

Compliance - Upon receiving a shutdown signal from 
Normal Power Level, the control decelerates the engine 
to 20% thrust in 1 . 0 sec with complete shutdown occurring 
in another 1.5 sec. 

Paragraph 3. 2. 2. 5. The engine shall be capable of shutdown 
at any time during the start sequence. 

Compliance - The control upon receiving a shutdown signal 
will shut the engine down at any point during the start 
sequence or thrust level transient above 20%. 

Paragraph 3.2.3. The engine shall be capable of changing 
thrust between Emergency and Minimum power level as 
rates less than or equal to 7000 lb per sec. 

Compliance - The engine and control system response to a 
ramp input on thrust is equivalent to a lag of approximately 
0. 125 sec time constant. This response rate will hold 
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thrust well within the accuracy as defined above for a com- 
manded thrust rate of 7000 lb per sec. 

Paragraph 3.2.4. The engine shall respond at a sea level 
thrust rate of no more than 700,000 lb per sec and no less 
than 120,000 lb per sec when given a step command re- 
sponse. 

Compliance - The control upon receiving a power level step 
command changes thrust at a rate of 330,000 lb per sec 
during an acceleration transient and 440,000 lb per sec 
during a deceleration transient through a rate controlled 
servo. 

10. Paragraph 3.2.5. The engine shall be capable of continu- 
ously increasing or decreasing mixture at a rate of no less 
than one ratio unit per three sec. 

Compliance - The control through a rate limited servo can 
change mixture ratio at a maximum rate of one ratio unit 
per sec. 

Paragraph 3.2.7. The engine shall not require monitoring 
external to the engine of any parameter as a prestart redline 
.. other than an electrical engine ready signal. The engine 
_ shall be capable of functioning with all critical internal 
parameters monitored by the engine control system. 

' - £*- - Compliance - The control system sends out a ready signal 

1/ .. a ^ ter the internal engine monitored parameters are safe 

1 * starting. The control svstem will prevent start or move 
th® engine to a safe region after starting if any of the 
- — critical engine parameters approach an unsafe limit. Engine 

protection is completely self contained in the control system 
' and can only be switched out by the abort override command. 

~ Paragraph 3.2.8. The engine shall not produce low frequency 
*-• -thrust oscillations. 

f. Com pliance - The engine with the valves scheduled in the 
~ "open loop mode is an inherently stable system. The closed 
loops added to control thrust and mixture ratio are sized 
such that the engine and control system produce a stable 
■*'*' system. 

13. Paragraph 3,5.2. 1.4. The engine shall operate at normal 
power level over the propellant inlet conditions. 

*” Compliance - The closed loop control mode accelerates, 
decelerates the engine and holds thrust and mixture ratio 
accuracy during steady state operation for the varying 
inlet conditions specified. 
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Pratt & Whitney Aircraft Imposed Transient Requirements 

1. The control shall accelerate and decelerate the engine 
without the aid of closed loops to keep critical engine 
parameters within safe limits. 

. Compliance - Resets are applied by the control to the 
basic valve area schedules during a transient to offset 
unfavorable engine dynamic characteristics which cause 
critical parameters to approach a limit. 

2. Overshoots on critical engine parameters shall be limited 
to the following percent of their final steady-stage value: 

a. High pressure pump turbine inlet temperature - 1.5% 

b. High pressure fuel turbopump speed - 0. 30% 

c. High pressure fuel turbopump exit pressure - 0.60% 

d. High pressure oxidizer turbopump speed - 0.20% 

* e. High pressure oxidizer turbopump exit pressure - 0. 40% 

Compliance - Accelerating the engine to Normal Power 
Level produces no overshoots above the maximum required 
except for the high pressure oxidizer turbopump exit pres- 
sure. This pressure overshoots its final steady pressure 
t)y O'. 80 percent. * 

3. The actual transpiration cooling flow shall not be equal to or 
below the required value at any time. 

Compliance - The transpiration coolant valve is reset open 
to increase the cooling margin during a transient. In e 

addition, closed loop control of the transpiration coolant 
■* manifold pressure ensures adequate cooling flow during 
steady -state. 

4. The main chamber mixture ratio shall not be equal or or 
above 8.0 ratios. 

Compliance - The resets and closed loops in the control 
system overcome the engine dynamics and keep main 
chamber mixture ratio well away from the 8.0 ratio limit. 

5. The available NPSP shall be greater than the required for 
both the fuel and oxidizer high pressure turbopump. 

Compliance - The engine transients are requested at a rate 
which allows the low pressure turbopumps to maintain sub- 
stantial NPSP margin at the inlets of the high pressure 
turbopumps. 


6. The low pressure fuel and oxidizer turbopump required 
NPSP shall be less than 2.0 and 8.0 psi respectively. 

. Compliance - The available net positive suction pressure of 
the fuel and oxidizer low pressure turbopumps is governed 
by the engine propellant inlet conditions. The transient 

* NPSP of these pumps does not exceed the eteady-state 
* design limits which are below the minimum available at 

the engine inlets. 

7 . The prebumer mixture ratio shall always be within the 
bounds of 0.25 and 2.0 ratios. 

Compliance - The engine transient is controlled such that 
preburner mixture ratio always remains well within the 
lower and upper bounds of 0.25 and 2.0 respectively. 

3. Pratt & Whitney Aircraft Imposed Protection Requirements 

The following engine parameters shall be prevented from exceeding their 
upper limits: 

1. Fuel high pressure turbopump speed and vibration level 

2. Oxidizer high pressure turbopumps speed and vibration 
level 

3. Fuel low pressure turbopump speed and vibration level 

4 . Oxidizer low pressure turbopump speed and vibration level 

5. Fuel high pressure turbopump required NPSP 

6. Oxidizer high pressure turbopump required NPSP 

7 . High pressure pump turbine inlet temperature. 

Compliance - The control system monitors the 11 limits given 

above and provides corrective action if any of the limits are 

exceeded. 

N. DESIGN SUBSTANTIATION 

The SSME control system, as described in the system description, was 
simulated and meets all the CEI Specification and the Pratt & Whitney Aircraft 
requirements but one: the overshoot requirement on high pressure oxidizer pump 
pressure. The engine cycle used was the 477, 000 lbf thrust space shuttle orbiter 
engine. 

For all the traces referred to, the system is settling at the initial condi- 
tions in the time before 0. 0 sec. Thrust or mixture ratio requests are put in at 
time equal zero, and are step commands. 
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The propellant inlet conditions are: 

Oxidizer - 105 psia, 162. 7°R 
Fuel - 30 psia, 37. 5° R 

1. Thrust Control 

The thrust servo velocity limits are set to change thrust a maximum of 
60%/ sec during an acceleration and 80%/ sec during a deceleration thus meeting 
the step command response on power level. These rates fall between the maxi- 
mum rate of 110%/sec and minimum of 19%/sec (orbiter, 632,000 lbf percen- 
tages) thrust change set in paragraph 3. 2.4. This velocity limiting is shown in 
all of the thrust response traces; for accelerations figures 11-15, 11-23, and 
H-31, for decelerations figures 11-25, 11-27, and 11-33. 

The thrust tolerance specification, paragraph 3. 1.1. 3, of ±1. 58% accuracy 
(orbiter) at 100% thrust level is met because of the integral closed loop on main 
chamber pressure. (Refer to PWA FR-4470. ) 

The low frequency thrust oscillation limits of paragraph 3. 2. 8 per curve 
No. S-100, sheet 3, are met because the thrust loop has been sized for a stable, 
damped response. Reference the thrust response traces, figures 11-15, 11-23, 
and n-27. 

2. Mixture Ratio Control 

The mixture ratio servo velocity limits are set at ±1. 0 ratio/sec. This 
velocity exceeds paragraph 3. 2.5 requirement of a maximum of 3. 0 sec to 
change 1.0 mixture ratio. Figure 11-30 shows the mixture batio response chang- 
ing at this rate. The mixture ratio command is stepped from 6.0 to 6.5 at time 
equal zero, and stepped down from 6. 5 to 5.5 at time equal 1 sec. Thrust com- 
mand is a Constant 100%. 

The mixture ratio accuracy requirement, paragraph 3. 1.2.4, of ±2.0% is 
met because of the integral closed loop on mixture ratio. (Refer to PWA FR-4470. ) 

3. Transient Limits 

P&WA transient limit requirements on engine parameter overshoots are 
demonstrated analytically and are met by this control system, with the exception 
of high pressure oxidizer pump discharge pressure overshoot. The following 
tabulation shows the required maximum and actual overshoots for an acceleration 
from 20 to 100%. The traces of these parameters are shown in figures II-7 
through 11-19. 



Overshoot 

Actual 

Parameter 

Limit a) 

Overshoot (%) 

Preburner Temperature 

1.5 

0. 95 

High Pressure Fuel Pump Speed 

0.3 

0.0 

High Pressure Oxidizer Pump Speed 

0.2 

0.0 


High Pressure Fuel Pump Pressure 
High Pressure Oxidizer Pump Pressure 


0.6 


0.0 


0.4 0.83 

The actual cooling flow always exceeds the required flow during the 
transient, with the margin dropping to a minimum of 8% at 1. 575 sec, as shown 
in figure n-20. Prebumer mixture ratio is required to be between 0. 25 and 
2. 0 ratios and during the transient it varies from a low of 0. 8 ratio to a maxi- 
mum of 1. 09 ratio as determined from the printout of the transient. Figure 
H-16 shows that the main chamber ratio did stay below 8. 0, with the mixture 
ratio at the throat rising to a maximum of 7. 13 at 0. 25 sec. Excess ft PSP mar- 
gins are maintained for all the pumps as shown in figure 11-21 for tb<: high pres- 
sure turbopumps and figure 11-22 for the low pressure turbcpumps , 

4. Operating Limits 

P&WA defined operating limits on engine parameters are maintained by 
the protection loops of the SSME control. The action of all the protection loops 
is the same: slow or reduce the thrust servo output as a function of the protec- 
tion error. Since the action is the same, overspeed prccection is demonstrated 
generally by protection on high pressure oxidizer turbopump speed only. 

Overspeed protection is shown in figures 11-35 and 11-36. The high pres- 
sure oxidizer turbopump maximum speed reference was lowered from 18,824 rpm 
to 15,281 rpm so that the pump would hit a speed limit during the transient. 
Figure n-35 shows that the protection loop overrides the 100% thrust command 
with the servo settling out at 87% thrust and oxidizer pump speed exponentially 
approaching the maximum value. Ac the end of 2. 2 sec the speed is 138 rpm 
from the limit. 

Preburner overtemperature protection is shown in figure 11-38. The 
maximum turbine exit temperature reference was lowered from the normal 
2075° R to 1694° R. During the 50 to t00% thrust transient, the overtemperature 
limit was reached and the system in settling out at 85% thrust. At the end of 
2. 2 sec the oxidizer turbine exit temperature is 36° R below the limit. 

5 . Open-Loop Capabilities 

To demonstrate the capabilities of the open loop control mode, traces are 
included of transients with all closed loops opened. Figures 11-31 and 11-32 
show the response to a 20 to 100% thrust step command. Figures 11-33 and 
n-34 show the response to a 100 to 20% thrust step command. 

The commanded thrust levels were reached with all the critical engine 
parameters well within limits. 

O. CAPABILITIES 

1. The control system is flexible in its design to easily accom- 
modate changes in engine size and dynamic characteristics. 

2. In holding thrust and mixture on point, the closed loop con- 
trollers are designed to handle variations in propellant inlet 
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conditions and a variation in engine components by first 
utilizing the full area capabilities of the propellant valves. 

This control scheme permits a wide range of component 
variations to occur before a critical engine parameter reaches 
its limit. 

The integral controllers provide trim accuracy on thrust and 
mixture to within the capabilities of the sensor measurement 
tolerances. 

The control system has the capability of accelerating and 
decelerating engine thrust and provide mixture ratio changes 
safely if the closed loop sensors are lost. The reliability of 
the vehicle of completing its mission is greatly enhanced by 
this basic open loop control feature. 



Acceleration, 20 to 100% Thrust, at Mixture Ratio = 6.0 


a/r rati? 


Figure 11-15. Thrust, Request and Actual 


Figure 11-16. Mixture Ratio, Engine and Throat 
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Acceleration, 2d to 100% 
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Thrust, at Mixture Ratio = 6.0 
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Figure 11-18. Pump Speeds, Fuel and Oxidizer LP and 
HP Ihimps 


■ •» 

f > 


Pratt & Whitney Pircraft 
PWA FR-4249 

ORIGINAL PAGE IS Volume II 

OF POOR QUALITY 





Acceleration, 20 to 100% Thrust, at Mixture Ratio = 6.0 
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High pressure cyiDizra 


PUMP DISCHARGE PRESSURE 


Figure 11-20. Transpliation Cooling Flow, Percent 
Excess 


Figure 11-19. High Pressure Pump Output Pressure 
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Acceleration, 20 to 100% Thrust, at Mixi^re Ratio = 6,0 





U>U PRESSURE cm VCR 

tUrbopump hcisi -nipsp 


lUR^OPUMP E«te«S 


Figure 11-21, High Pressure Pumps' Excess NPSP 


Figure 11-22. Low Pressure Pumps' Excess NPSP 














"CTIWI. CNOIMC. THRUST 


<VP RATIO 


vnoeiTY WHITE* ■ 
thrust k tat ax 


Figure 11-25. Thrust, Request and Actual 


Figure 11-26. Mixture Ratio, Engine and Throat 
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Deceleration, 100 to 20% Thrust, at Mixture Ratio = 6.0 





VCUKITY UMlTtD 
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Figure 11-29. Mixture Ratio, Engine and Throat 


Figure 11-27. Thrust, Request and Actual 
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Mixture Ratio Change at 100% Thrust, 6. 0 to 6. 5 to 5. 5 . 
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Open Loop Acceleration, 20 to 100%, at Mixture Ratio - 6.0 


Figure 11-32. Mixture Ratio, Engine and Throat 


Figure 11—31. Thrust, Request and Actual 
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Figure 11-34. Mixture Ratio, Engine 


Figure 11-33. Thrust, Request and Actual 
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High Pressure Oxidizer Turbo pump Overspeed 
, ,,, „ Protection, -Acceleration, 50 to J.00% Thrust, at 
Mixture Ratio = 6. 0 
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Prebur;ner Overtemperature Protection - Acceleration, 
50 to 100% Thrust, at Mixture Ratio =6.0 



Figure 11-37. Thrust, Request and Actual 
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Figure 11-38. Preburner Temperature 
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SECTION HI 

CONTROL IMPLEMENTATION 


The magnitude and complexity of the SSME control requirements and the 
need for comprehensive onboard checkout and maintenance support have 
dictated the choice of a digital computer as the Engine Command Unit (ECU). 
Although there are many advantages to an engine-mounted electronic control 
system, much design attention must be paid to the mechanical packaging of the 
computer to ensure that it will have satisfactory life and reliability. 

A. SSME SIGNAL PROCESSING POSES SPECIAL PROBLEM 

Although the ECU is essentially an electronic digital computer, the design 
problems center around the input/output circuits. These analog signal con- 
ditioners and their associated multiplexers and digitizers make up more than 
half of the ECU, and must be designed specifically for the SSME control system 
requirements. There are no off-the-shelf electronic engine controls that can 
handle the large number of input signals required by this application. If existing 
air data-type computers are modified to process the signals needed for engine 
control and diagnostics, the number of internal connections required becomes 
very large and causes a proportional decrease in reliability. Preliminary 
design studies showed that expanding existing air data-type designs to meet 
SSME requirements, with conventional motherboard and plug-in card config- 
uration, resulted in a card-to-motherboard connection count of nearly 5000 
junctions. This number was based on packaging the ECU on 44 circuit boards, 
each with a component area of 40 in. 2. Each of these boards required approx- 
imately 100 connections to the motherboard. This large number of connections 
severely compromises unit reliability, since the basic reliability of even a 
hard wired connection is much lower than an etched circuit conductor or mono- 
lithic conductor. If plug-in connectors are used, further reduction in reliability 
would be expected in the high vibrational environment of an engine mounted 
control. (Refer to Avionics Trade Studies, PWA FR-4439. ) 

B. ECU DESIGNED SPECIFICALLY FOR SSME APPLICATION 

The ECU internal partitioning is based on a functional organization. 

Since the logical flow through the ECU from input to output is a series of 
converging paths, separation of the circuitry into complete functional blocks 
results in the minimum number of paths from one block to the next. Putting 
a complete function on one circuit board, however, requires a board of very 
large area, and requires that the mechanical packaging be tailored to this 
partitioning concept. 

C. THE ENTIRE CPU IS ON A SINGLE FRAME 

The ECU is assembled on 12 large frames in one enclosure (figure III-l). 
Seven of the frames carry the input/output processing circuits. One frame 
contains the computer, two frames contain the memory, one frame contains 
the qualifiers, and one frame contains the power supply. Each frame consists 
of two identical circuit boards, one for each of the two controls. Figure III-2 
shows the construction of the frames and circuit boards, as well as the frame 
grid which provides a thermal path between the components and the frame. 


6 

t 


Hi-i 


D. FUNCTIONAL PARTITIONING REDUCES INTERNAL 

CONNECTIONS 10 to 1 

The advantages of using these large frames is evident in the number of 
frame-to-frame connections required. Because each frame contains a 
complete functional block, and the connections are primarily limited to single 
input, single output, and power, the interframe wiring requirements axe 
reduced to a total of 450 connections for both controls , compared to 4500 
necessary for the plug-in card concept. This gives a significant improvement 

in reliability. 

Each ECU frame is wired directly to the input and output electors 
with which it is associated. This provides a means to systematically assembl , 
test and repair the ECU, because a frame and its associated input/output 
connectors can be removed and operated independently, without breaking 
the wiring between the frame and the interface connectors. 

Wiring from frame to frame and from frame to interface connector is made 
with flexible circuit wiring. This low mass wiring is well suited for the high 
of the e^„e mounted control (figures m-3 and m-4). Noin erntd 
connectors are used In the ECU, and a multilayer motherboard is eliminated, 
representing a significant cost savings. 



Figure III- 1 . Engine Command Unit Package 


FD 52650 
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E. FAN-OUT FRAMES PROVIDE MAINTAINABILITY 

The 12 frames which make up the ECU are hinged along the wiring side, 
so that the stack can be fanned out, allowing access to any component (figure 
m-5). The flexible circuit wiring allows the frame to hinge without offering 
resistance, and the strain relief provided for the flex wiring allows it to 
sustain many thousands of cycles without physical degradation. 

The frame is wired to the interface connectors that carry its input/output. 
The hinge pin can be removed and any frame removed from the stack, along 

III— 4 
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with its associated interface connector (figure m-6). This allows ; the .tome 
Sta derated by applying the signals directly to its associated interface 
connector, reducing the requirement for test connectors. 



Figure III-5. Hinged Frame Detail 


FD 5262C 



FD 52645 


4 Figure III-6. Single Removable Frame 
'^lug-in MEMORY MODULE PROVIDES FLEXIBILITY 

A «ed tH^re 

3EE&5& pa^r ters. en fn ad^tion, it contains the identification codes 



m-5 


tha; allow the data bus to address an individual engine. The memory module 
plugs into the ECU on the connector interface panel (figure HI-7). The recess 
is sealed and contains an environmental connector similar to those used for 
the harness connections. The module is a line replaceable item. When an 
ECU requires replacement, the module can be quickly transferred to the 
new ECU. 



Figure III— 7. Memory Module FD 52647 

✓ — 

- For ground trim during the initial engine hot firing, the memory module is 
removed and a trim umbilical cord is plugged into the ECU through the memory 
module connector. A test stand computer automatically trims the engine to the 
required thrust and mixture ratio, and permanently stores the trim valves in 
the memory module, which is then reinstalled in the ECU. Should the memory 
module ever require replacement, it can be duplicated by storing the trim 
values in another memory module. This can be done without firing the engine 
by simply utilizing the information recorded when the engine was originally 
trimmed. 


G. THE ECU USES FORCED CONVECTIVE COOLING DURING GROUND 
OPERATION 

- ~ The ECU does not need active cooling for the boost, orbit, and reentry 

phases of the mission. Thermal mass capacitance of the ECU structure is 
* sufficient to absorb the heat generated during boost and reentry, due to the 
relatively short durations of these phases. 
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The ECU must operate for long periods while the vehicle is being 
prepared for launch, and some cooling is required to remove the normal internal 
heat of the operating control. 

Assuming a maximum ambient air temperature of 130 F , a trade study 
was performed to evaluate several candidate cooling schemes. (Refer to 
Avionic? Trade Studies, PWA FR-4439.) 

Dry Gas Purge - While a dry gas purge is the simplest from an 
engine standpoint, the requirements made on the vehicle and 
ground systems to provide 120 lb/hour of purge gas for each 
ECU made this appi oach impractical. 

Natural Convection - The use of cooling fins on the ECU to provide 
ground cooling increases the weight and volume of the ECU. The 
fins, to be effective, must be thin and closely spaced. This design 
would have been highly subject to handling damage. Designing the 
ECU for maximum heat transfer to the outer finned case also is a 
disadvantage when designing a minimum power heater for low 
orbital temperature. 

Heat Pipe - The heat pipe was rejected because it severely com- 
promises the maintainability of the ECU. Both the internal 
structuring and the ECU eng'ne mounting become complex if an 
evacuated heat pipe must be carried through interfaces, with 
provisions made to couple anc’ uncouple the heat pipe. Another 
significant problem was the inability to locate a suitable heat 
sink on the engine to terminate the heat pipe. 


Forced Convective Cooling - The ECU uses a forced convective 
ground cooling system. This cooling scheme uses two vane 
axial blowers which transfer amb.’ent air through the cold wall 
sandwich construction of the ECU. The airflow does not flow 
through the aluminum grids on the circuit beards and through 
the frames. 


r 


- V 


Air enters the cold wall through a large area filter designed to 
prevent contamination of the cold wall passages. The cooling 
system inlet and outlet configurations provide unit explosion 
proofing, (figure ni-8). 


H. ECU USES TWO HEATERS FOR ORBITAL PROTECTION 


The ECU contains a low wattage electric heater to protect the internal 
components of the ECU from low temperatures experienced during the long 
orbital periods. The heater has two power lines. To prevent excessive 
power consumption from the two heaters when both are operational, a heater 
configuration has been designed so that the power consumption only changes 
10% when either a heater element opens or a power line fails (figure HI-9). 

f • 

.Vacuum cell insulation is used on the outer skin of the ECU to augment 
the heater system and hold its power requirement to a minimum. Thermal 
isolation shims are installed in the mounting brackets to reduce heat losses 
by radiation and by conduction to the engine mass (figure HI-10)'. 
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Figure III- 10. ECU-to- Engine Mounting FD 52617 

I. THE ECU ASPIRATES WITH AMBIENT PRESSURE CHANGES 

Two general sealing configurations were considered: aspirating and 
hermetic sealing. A trade study explored the two appraches. Consideration 
was given to design simplicity, maintainability, explosion proofing, and 
seal leak testing. It was determined that an aspirating box , with appropriate 
explosion proofing, is the more desirable approach. The aspirating 
configuration will avoid the difficulties associated with hermetically sealing a 
large enclosure, and greatly improve the maintainability of the ECU. 

(Refer to Avionics Trade Studies, PWA FR-4439.) 

The aspirating valves are located between the ECU interior and the cold 
wall cooling plenum, and do not open directly to the outside. Thus, the 
aspiration shares the filter and explosion proofing of the cooling system. 

The aspirating valves maintain a 2 psi pressure differential of either polarity 
between internal and external pressures. This limits the stresses for which 
the large outer case of the ECU must be designed. 

J. ECU STRUCTURE DESIGNED FOR HIGH VIBRATIONAL ENVIRONMENT 

The large physical size of the ECU (figure III-ll), in conjunction with 
its severe mechanical environment, makes the package construction particularly 
critical. The high g loadings associated with vibration, shock, and 
acceleration, as well as differential pressure forces necessitates an extremely 
stiff package. 

Since weight is a major consideration, a construction which has a high 
stiffness/weight ratio is desirable. There are three general methods of 
providing sti r f panels: large panel thickness, moderate panel thickness with 
additional structural support, and honeycomb (sandwich) type construction. 

A trade study shows that the honeycomb structure offers far greater stiffness 
at a considerable reducti_.i in weight than either of the other two construction 
techniques. (Refer to Avionics Trade Studies, PWA FR-4439.) 

Ill— 9 



Figure III-ll. ECU Dimensions 


FD 52649 


A stress analysis on a typical honeycomb panel was performed to verify 
the panel design. A summary of some of the pertinent results is as follows: 

18 in. x 24 in. x 0.4375 in. . 

2.6 lb 

213 Hz 


- - - Max Deflection 

Max Bending Stress 
’ - Margin of Safety (EL) 


; - Margin of Safety (Ult) 9.15 

The ECU case is formed of honeycomb structures, with two walls bein^ 
used as active cooling heat exchangers. The outer case of the ECU is covered 
with a vacuum cell insulation to reduce radiation heat loss. Thermal insulating 
shims are used at the interface of the ECU and engine mounting surfaces to 
reduce conductive heat losses. 

Table m-1 presents the structural design requirements and capabilities 
t. °* **CU. A current application of the corrugated panel structure is the 

Navigation Data Repeater Converter electronic package used on the 53A 
aircraft. 

„ The large frame construction with no internal connectors, and with 
; : ' *an-out maintenance features is used in the JFC89 and the JFC90 in the 
• • -F14B/F15 engine-mounted fuel controls. A similar fan-out arrangement is 
'Used in the ST9 engine -me unted fuel control developed for the Army. 


0.0344 in. * 
1970 psi 
6. 38 


Size 

• - - - Weight 

£'~ --- Resonant Frequency 
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Table m-1. ECU Structural Design Requirements and Capabilities 



Dry Engine Checkout Temperature ’ ;* ;v -30 to .+130 °F -65 to +160° F 

» I” 'S <? 

‘ ' • j 1 : •/, ! : 

Fueling and Hold Temperature > | \ -30 to +130° F -65 to +160° F 

1 > ! ! , 

ri i 1 | 

Boost Temperature (250 sec/max) i ^ -30 to +400° F -65 to +600° F 

Orbit Temperature (30 days/max) -360 to+240°F -360 to 300° F 

Reentry Temperature (2100 sec/max -orbiter) 1 400°F max 600°F 

.Vibration 2 g, 1-500 Hz 20 g random, 5-2000 Hz 


Shock 

Acceleration 

P O 

■ 

12 g, 10 ms 

50 g, 10 ms 

Steady 

§f 

■JO . 

+3 g longitudinal 
+4 g lateral 

10 g max 

Dynamic 

1 * i 

Q £ 
> > 
- f - * o 

§» 

±10 g longitudinal 
±10 g lateral 

20 g max 

Acoustic Noise » ' 

1 

125 to 155 db 
(5-6300 Hz) 

125 to 155 db 
(5-6300 Hz) 


External Pressure i \ ‘ 15 psi - zero 15 psi - zero 

Humidity 0 to 100% 0 to 100% 
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K. VEHICLE COMMANDS AND ENGINE DATA CARRIED ON A SERIAL 

DIGITAL DATA BUS 

The data bus interface design (figure III —12) assumed employs two data 
lines, with data lines active at any given time. The data lines will be connected 
to each of the two computers that comprise the ECU on each engine. The two 
comp ilers are simultaneously active, but one computer has priority and is 
dominant over the other. During normal engine operation, however, the vehicle 
may-ignore the interaction of the computers and simply address a specific 
engine. If the computer sends data to the engine, both computers will receive 
the data. If the computer calls for data from the engine, the dominant computer 
will supply the requested data, and will identify itself in each engine control 
system status word (111011). During any evaluation of the engine system, the 
vehicle ma? squire data from a specific engine computer to check the per- 
formance oi uiat computer. The multiplex system includes this capability, 
which the vehicle may exercise at any time, although use during normal opera- 
tion would increase the data bus load. 


Data Data 

Line Line 

1 2 



Figure III-12. Multiplex System FD 52616 

Multiplex system failures may occur, either to a data line or to a 
multiplexer unit. If a multiplexer unit fails so that no data can be received, the 
engine computer containing the multiplexer will shut down, but the remaining 
computer will retain control of the engine and vehicle operation will be unaf- 
fected. If a multiplexer fails so that no data can be sent, the vehicle may 
disconnect that computer with the engine command 1 word (111100). 

The multiplex system employs three types of words to implement a 
communication. Control word 1 supplies the address of the unit the vehicle 
computer wishes to engage in communication. Control word 2 specifies the 
data which are to be exchanged. However, the pretank memory dump command 
in the engine command 1 word (111100) causes a transmission of data, from 
the engine to the vehicle, which is only indirectly specified by control word 2. 
The data word is the main objective of the communication, and contains data 
with identification. 
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Manchester coding of all information on the data line allows inclusion of 
time and data signals on the same line. The phase modulation gives positive 
evidence of transmission loss by the lack of transitions, and decoding is 
relatively simple v/ith digital logic gates. 

The multiplex unit provides an interface with the data bus line and, for 
the engine computer, with the memory unit of the central processing unit. 

The multiplex unit is connected to the memory by a direct memory access 
channel. When the multiplex unit requests access to the memory, the computer s 
central processing unit stops the execution of the present instruction and pei forms 
a memory cycle (either read or write) for the multiplex unit. As soon as the 
multiplex unit's memory access request is removed, the computer's central 
processing unit will return to the instruction that was being executed prior to 
the memory access request. 

L. MANCHESTER CODING PROVIDES DATA AND TIMING ON 

ONE DATA LINE 

A shielded, twisted-pair cable carries digital signals between the vehicle 
and the engine command unit. This bidirectional communication is a bipolar 
phase modulated signal known as Manchester coding. Figure 11-13 shows a Man- 
chester signal separated into data and clock signals. The bipolar Manchester 
waveform is converted into a unipolar phase modulated binary signal. This sig- 
nal is examined for rising and falling edges; the time between these edges will be 
either a long interval or a short interval. A long interval indicates a reversal 
of data, i.e. , a logical zero becoming a logical one or a logical one becoming 
a logical zero. A short interval indicates that data have not changed state. The 
decoding of Manchester data is predicated on the first bit of the received word 
being a logical one. When this first bit is detected, the gap waveform is set 
to a logical zero, indicating that reception of data is in progress. It is reset 
when data are no longer being received. The gap waveform is used as the 
envelope of the received word. The 4 MHz clock signals provide internal 
timing for decoding the Manchester signal. Since the first bit of each word is 
a 1, tne data signal always starts at this level. When the interval betveen 
edges of the incoming word is long, the data signal changes state. A data 
clock pulse is generated to coincide with the end of one bit and the beginning 
of the next bit, which ensures the presence of stable data just prior to and just 
after the data clock pulse. 

The creation of the bipolar Manchester transmission is shown in 
figure HI-14. Unipolar phase modulated binary data are formed by an 
"exclusive or" of binary non-retum-to-zero (NRZ) data and the 1 MHz clock 
signal. The inhibit signal is the envelope of the transmitted word and gates 
the unipolar phase modulated signal to the transmitter, which produces the 
bipolar phase modulated signal. 

M. COMMUNICATION BETWEEN THE VEHICLE AND THE ECU WITH 

THREE DIFFERENT W r ORD TYPES 

One control word is used by the vehicle computer to address a particular 
system, i.e. .engines, and unit of the system, e.g. , engine 5, and to direct 


the system unit to perform a specific operation (receive, transmit, etc.). A 
second control word which defines the block of data to be processed provides 
starting and ending points. The third word type is a data word containing data 
and identification fields. 



• Bipolar Phase Modulated Binary Data (Manchester Input) 


i i 1 i 1 r *~ 

Unipolar Phase Modulated Binary Data 


Gap 

JTJTJTJTJTJTJTjaJTJOJTJlJT^^ 



_Data Clock 


Figure III— 13. Manchester to Binary Conversion FD 52635 



Output Data Work (Binary NRZ) 



Inhibit 


i — l. - i — L T r ^- - r~i_fr 

1 MHz Clock 

i 1 r — i i 1 i — "■ 

Unipolar Phase Modulated Binary (Manchester Transmission) Output 



Manchester Transmission (Bipolar Phase Modulated Binary) to Vehicle 
Figure III— 14. Binary to Manchester Conversion FD 52636 
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Ihe format for Control Word 1 is as follows: 


Number 

of Bits 1244 2 4 1 11 

Control Word System Engine Engine Spare Transmit Receive Odd 
Bit Type Address Address Computer Parity 

This word is used to initiate a communication between the vehicle computer 
and a second unit. The first bit is always set equal to a logical one (a require- 
ment of Manchester coding). Two bits identify the word type - Control Word 1. 

The System Address is four bits and is the code of the system addressed. (The 
engine system will be a single code.) The Engine Address is four bits, and 
allows addressing of the engines individually or together. The Engine Computer 
is two bits and is used only in conjunction with a Transmit bit to select the 
specific engine computer that is to output data. Ordinarily, this field will be 
left blank and the dominant engine computer will answer the transmission. 

Four bits are shown as Spare, but this space is actually reserved for com- 
munication system control codes. The Transmit bit calls for a transmission 
from the addressed unit to the vehicle computer. The Receive bit indicates 
a transmission will be made from the vehicle computer to the addressed unit. 

The Odd Parity bit creates an odd parity condition in the word. 

The format for Control Word 2 is as follows: 



Number 
of Bits 

1 

2 

6 

6 4 

1 


Control 

Word 

First Word 

Last Word Spare 

Odd 


Bit 

Type 

Number 

Number 

Parity 


This word is used when data are to be exchanged between the vehicle 



computer and an addressed unit. The first bit is always set equal to a logical 
one (a requirement of Manchester coding). Two bits identify the word type - 
Control Word 2. The First Word Numoer is six bits, which gives the word 
number of the first word to be transmitted or received. The Last Word 
Number is six bits, which gives the word number of the last word to be trans- 
mitted or received. Four bits (Spare) are not used. The Odd Parity bit 
creates an odd parity condition in the word. 


The format for a Data Word is as follows: 


Number 
of Bits 

1 

2 

6 

10 

1 


Control 

Bit 

Word 

Type 

Word Number 

Data Field 

Odd 

Parity 



The data word may be either received or transmitted by the multiplex 
system. The first bit is always set equal to a logical one (a requirement of 
Manchester coding). Two bits identify the word type - Data Word. The Word 
Number is six bits, which serve to identify the data in the data word. The 
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Data Field is ten bits, which contain the word information. The Odd Parity 
bit creates an odd parity condition in the word. 

N. COMMUNICATION WORD REPERTOIRE 


4 * u, A data words received and transmitted by the ECU is presented 

in table III-2. The data words sent by the ECU to the vehicle include engine 
parameters, control unit signals, and sensor failure information. These 
60 words are prefaced by identifiers (000000 to 111011), and are arranged by 
sampling rate starting with 50 samples per second and ending with 5 samples 
per second. The data words sent by the vehicle to the ECU, are various 
preflight and inflight commands, which have been given the identifiers 111100 
through 111111. In addition to the sampling rate, the data, address, and 
overhead bit rates (bits per second) are presented for each word. Each word 
contains ten bits for the data, six bits for the address (identifier), and four 
bits for overhead (control, identification, and parity). In addition to the data 
words, two control words are required to initiate each communication, and 
these words are included in the tabulation of the data bus load for each engine 
(assuming the vehicle will communicate only with the dominant engine 
computer). 


Table III-2. Communication Word Repertoire 


Ward H 

Word 


Word Number 

Data Word 

•ample 

Rate 

tela 

Bit 

Rate 

Addreaa 

Bit 

Rate 

Overhead 

Bit 

Rate 

L ta Scaling 

Range (Bit Resolution) 

•11 Ml 

Mala Combusdoii Chamber Pressure 

M 

SM 

S 

SM 

0-3500 pel 

3.410 pal 

mmm 

CMMaer La Inlet Press. rv 

SO 

SM 

1M 

IM 

•>215 psl 

•.SOM put 

•MMl 

Fuel LM Inlet Pressure 

SO 

SM 

1M 

1M 

®-ae pm 

•.•St j€ pat 

MN1I 

OddUer HP Turbine Dtackarge Temperature 

If 

1M 

M 

M 

500-2500'* 

1 . 9531 *R 

MMI1 

Ptosl HP TUrbtae Dtacharge Temperature 

19 

1M 

M 

M 

500-1400*0 

1. 0S04*R 

•Ml 00 

Oth» Far Jiff VlbraHoa 

SO 

SS0 

1M 


5-50 Ms; O-SOG 

0. 02*2 MG 

•00101 

Ottiwr Turbopump Vibration 

so 

-_m_ 

1M 

IM 

46-500 Hi; t-SOC 

0.0292MG 

Mill* 

Fuel LSI VlbraHoa 

so 

SM 

1M 

IM 

10- 1 M Hi; 0-JOG 

0. 029294G 

•Mill 

PWl Turbopump Vibration 

so 

SM 

1M 


40-1000 Hi; 0-3 

0. 029244G 

•OlOOO 

Prabaiaat ttodlrer Valvs Pool Boa 

20 

SM 

1M 




Ml Ml 

Mala Ckambar Caodlaer Valve Position 

20 _ 

SM 

1M 

IM 

6-M* 

TBD 

M1010 

Male fuel Valve Position • 

SO 

MW- 

1M 

IM 

6-M* 

TBD 

Ml «11 

TraaaptrmOoa Coolant Valve PoelUoa 

SO 

SM 

IM 

IM 

Mat 

TBD 

Ml! 00 

Mala Ckaaabvr Lonal tudlual Acceiaranoa 

SO 

SM 

1M 

100 

lOo-lt.OOO Hi; 
6- SMOG 

2.44I4G 

Ml 101 

Preburaer Loafttudlaal ArcelarmUoa 

20 

SM 

1*0- 

IM 

100-10.000 Hi; 
6-S000G 

2.44I4G 


>1 1 


Word Ml 1 


Word Mi * 


Discrete Word I 

Extendible No.il. Helium Broke Roleaold 
FMMn 

TUrbopump Lift-off Seel Helium Simply 
Sole. eld Position 

Fuel Hick Preoeure Turbopump Lift-Off He 
Soleoold Position 

Fuel Recirculation Valve PoelUoa 

Mala Chamber LOX Rrclrrulatloa Valve 
Poaltloa 

Preburaer LOX Recirculation Valve Position 

Hick Preoeure Turbopump Lift-Off Seal Fuel 
Solenoid Position 

Preburner Primary Helium Purge Crmply 


IN 


1M 


*-l 

•-1 

•-1 

•-1 

•-1 

•-1 

•-I 

•-» 

•-I 
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Table IH-2. Communication Word Repertoire (Continued) 


AMthi 

Bit 


Data Word 


(Bit Kcofatton) 


ilium Purge 

An 

Preturaer Secoadarp Purge HelluM 


H 0010 


N*IW 

MMM 

MMI* 

NMII 


19101# 

ioioii 

1011 ** 

miim 

Min* 

101111 


U 0 M 1 
•MU' 
•Hit’ 
WWd*«! 
■OH W 

■OHM* 

•HMI 

IHMI 

■OHM' 

■OHM' 

•I 0 H 0 


M#»l* 
MOM' 
M01M 
MOIM 
MM If 
OOM11 
MUM 
11*01 


r TOrtopump taut Preeeur* 
On ilzcr nowmeter IP 
Ckidaer Ttarbopump Otockiq* PrtJ 
reel TotOopioop tatat Pre.ee re 
Peal rV»w»«t»r iP 

pool TtltwP—P Diacharge 3>reeaur« 
Pool LP lOrtaao l«lot Preerur* 
Pruburaer Cbamber Preeauro 
TratepIreUoe Coolant Supply pr 


100 

100 

100 

100 

100 

100 

100 


0-1 

0-1 

0-SMpolo 
O-100 paid 
0-7200 poU 
O-SOOpHo 
0-SOpoM 
O-TOOOpoU 


O.Mli pot 

0.00700 pi 

0. 70311 ft 

o. tom pa 

0.04003 pa 

4.030 pH 
4.340 pot 

3. 030 pol 


Culm IM Speed 

19 

190 

90 

49 

1 

I 

4. 9929 rpn 

QOlM HilOopump Sftfd 

19 

100 

•0 

49 

*-20.000 rptn 

19.8912 rpn 

Pool LSSMH 

19 

100 

00 

49 

0-11.000 tpa 

17.3701 Tfm 

Pool lbitopnmp k-ad 

IP 

100 

00 

49 

0-40.000 rpta 

30.0034 rpm 

S>'oo< Holloa Sopplp Proooure 

10 

190 

90 

49 



QBOUor LSI talot Temperature 

s 

89 

90 

99 

100-178*1 

0.01400'B 

(Blur ■niHopxmP talot Tom P* 

s 

89 

90 

29 

109-108*1 

9.99441*1 

CbHior Tartepooip Houeing Tr"’P* r *‘“ r * 

8 

89 

90 

99 

199-809*1 

fc. 41992*1 

Port LSI talot Temperature 


89 

90 

2f 

99-45*1 

0.040479*1 

Pari Hiibcpomp talot Tom pc ra tore 

8 

89 

90 

99 

99-99*1 

9.999494*1 

Pori TMtmpump Houelof 1 ••fnporat»ro 

8 

89 

90 

*0 

28-899*1 

*. 34100** 

Port LP Turtle. talot Temperature 

8 

89 

90 

99 

499-1999*1 

4.84899*1 

bcnBto Noetic Poe It loo 

8 

80 

90 

99 

TK> 

TBD 

le lurn Spate* PaUaro Statue 

8 

so 

90 

90 

Coding TBD 

3. 3437** 

Lode. Computer Baa Temperature 

8 

80 

90 

20 

303-717'* 


Ducrete VoH 3 

SC 

289 

189 

199 



MtOMtaHee Valeo. Helium Sup»>l7 *‘ D *‘ Uo " 




9-1 


F t remble Soaalo Lack PoelUnti 





9-1 


tceadlble Settle Oeerrlrie SoIrnnLf ismltloo 





9-1 


Purl SOutoff Valeo Paaltloa 



• 


9-1 


knit tadtratloe Proburaor laeltcr 





9-1 


S|a(t hdrattoa Mole Burner 1 ****** 





9-1 


kart tadtraooe Preburoer l*t» ll ' r 





9-1 


Sport tadnOoe Mala Burner I*" 1 '"' 





9-1 


Vna^nilM Coolant Vnlve lirrof 

28 

289 

180 

199 

TBD 

TBD 

Pmtmraer CkKBter Valeo Kr n>r I**"* 1 

28 

289 

ISO 

199 

TBD 

TBD 

Mda Buraor auditor Valeo Hr H ,r ’•s**' 

28 

289 

180 

199 

TBD 

TBD 

dua Purl Valeo trror Signal 

28 

289 

ISO 

190 

TBD 

TBD 

Tiruat tattfratar kgaal 

28 

289 

ISO 

100 

TBD 

no 

Cxturt Ibfto Integrator Mgnai 

28 

280 

ISO 

109 

TBD 

TBD 

T-iaaotraOeu CoaUag tatograUT "‘O'** 1 

28 

280 

189 

199 

TBD 

TBD 

Pritouraor Rater Integrator Mg** 1 

28 

280 

189 

199 

TBD 

no 

1 Bnul AfdirtM 

28 

289 

189 

199 

9-1 ti 

O.IOOi 

Member Seeeoea aad Wafer I'rr.eure 

Sawn Swm 

8 

89 

90 

99 

• 



Morvi Ctawber Poeaaure * 

roM 


o-i 


£ 
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Table III— 2. Communication Word Repertoire (Continued) 


Word Number 

Word Bit 2 
Word Bit 3 
Word Bit 4 
Word Bit S 
Word Bit • 
Word Bit 7 

Word Bit • 

Word Bit 9 

110911 
Word Bit I 
Word Bit 2 
Word Bit 3 
Word Bit 4 
Word Bit 5 
Word Bit 6 
Word Bit 7 

110100 ' 
Word Bit 1 
Word Bit 2 
Word Bit 3 
Word Bit 4 
Word Bit 5 
Word Bit 0 
Word Bit 7 
Word Bit • 
119191 

Word Bit 1 ' 
Word Bl( 2 : “ 
Word Bit 3 " 

Word Bit 4 

Word Bit 5 
Word Bit 6 * 
Word Bit 7 
Word Bit § 
Word Bit 9 
Word Bit 10 
119110 
Word Bit I 
Word Bit 2 
Word Bit 3 
Word Bit 4 
Word Bit S 

Word Bit • 


Dots Word 


Dots 

Sample Bit 

Rate Bate 


Address 

Bit 


Rate 


Overhead 

Bit 

Rate Range 


Cfcta Scaling 
(Bit Resolution) 


Preburner Acceleration Sensor Palled 

Main Chamber Pressure Sensor A Failed 

Main Chamber Pressure Sensor B Failed 

Main Chamber Pressure Sensor C Failed 

Main Chamber Acceleration Sensor Failed 

Transpiration Coolant Supply Pressure 
Sensor A Failed 

Transpiration Coolant Supply Pressure 
Sensor B Failed 

Transpiration Coolant Supply Pressure 
Sensor C Failed 

LQX Pressure Sensors Status 5 99 

Oaidlxer LSI Inlet Sensor A Failed 

fetldxer LSI Inlet Sensor B Failed 

(Midi ter Turbopump Inlet Sensor A Failed 

fetidxer Turbopump Inlet Sensor B Failed 

Oaldxer Flowmeter AP Sensor A Failed 

Oaldxer Flowmeter AP Sensor B Failed 

Oxidxer Turbopump Discharge Senaor A 
Failed * 

Fuel Pressure Sensors Status S 99 

Fuel LSI Inlet Sene or A Failed 

Fuel I -SI Inlet Sensor B Failed 

Fuel Tyrbopump Inlet Senaor A Failed 

Fuel Turbopump Inlet Senaor B Failed 

FUel Flowmeter AP Sensor A Failed 

Fuel Flowmeter AP Sensor B Failed 

Fuel Turbopvnp Discharge Senaor A Failed 

Fuel LP Turbine Inlet Sensor A Failed 

Vibration Sensors and Igniter Cavity 

Temperature Sensors Status 9 90 

Oxidxer 131 Vibration Senaor A Failed 

Oaldxer LSI Vibradcn Senaor B Failed 

fetidxer Turbopump Vibration Sensor A 
Failed 

Oxidxer Turbopump Vibration Sensor B 
Failod 

Fuel LSI Vibration Sensor A Failed 
Fuel LSI Vibration Senaor B Failed 
Fuel Turbopump Vibration Sensor A Failed 
Fuel Turbopump Vibration Sensor B Failed 
Fxtenilble Noxxle Position Sensor A Failed 
Lxtendlble Noxxle PosIMon Sensor B Failed 

Oaldxer Temperature Sensors Status 3 99 

Oaldxer LSI Inlet Senaor A Failed 

Oaldxer LSI Inlet Sensor B Failed 

fetid xer Turbopump Inlet Sensor A Failed 

Oaldxer Turbooump Inlet Senaor B Failed 

CK idler Turbopjmp Housing Senaor A 
Failed 

Oaldxer Turbine Discharge Thermocouple 
A Tailed 


99 29 


39 


39 29 


39 


9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-! 

9-1 

9-1 

9-1 

9-1 


9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1 

9-1. 

9-1 


III— 1 8 


Pratt & Whitney Rircraft 
PWA FR-4249 
Volume II 


Table III— 2. Communication Word Repertoire (Continued) 


Ward Hwnber 

Somplo 

Data Word R*t« 

Data 

Bit 

Bala 

Address 

Bit 

Bate 

Overhead 

Bit 

Bate 

Range 

Data Scaling 
(Bit Resolution) 

Word Bit 7 

Oxt<flzer Turbine Discharge Thermocouple 
B Failed 




0-1 


Word Bit 8 * 

Out tier Turbine Discharge Thermocouple 
C Foiled 


: 


0-1 


Word Bit 9 

Oxlcfl ter Turbine Discharge Thermocouple 
D Felled 




0-1 


110111 

Fuel Temperature Sensor Status 8 

80 

30 

>0 



Word Bit 1 

Fuel LSI Inlet Sensor A Failed 




0-1 


Word Bit S 

Fuel LSI Inlet Sensor B Failed 




0-1 


Wonf Bit 3 

Fuel Turbopump Inlet Sensor A Failed 




0-1 


Word Bit 4 

Fuel Turbopump Inlet Senator B Failed 




0-1 


Ward Ml 5 

Fuel Turbopump Housing Sena or A Failed 




0-1 


Word BltC 

Fuel LP Turbine Inlet Senaor A Failed 




0-1 


Word BU 7 

Preburner Turbine Discharge Thermocouple 
A Fatted 

• 



0-1 


Word Bit 8 

Preburner Turbine Discharge Thermocmiple 
B Failed 




0-1 


Word Bit 9 

Preturner Turbtre Discharge Thermocouple 
C Failed 




0-1 


Word BU 10 

Pr etui roe r Turbine Discharge Thermocouple 
D Failed 




0-1 


111000 

9peed Sensor Status t 

SO 

30 

SO 



Word Bit 1 

ClaldUer LSI Sr aor A Felled 




0-1 


Word Wt X 

Ox'dzer LSI Sensor B Failed 




0-1 


Word Bl« 3 

Oai daer Turbopump Sensor A Failed 




0-1 


Word Bit 4 

Ok 1 (flier Turbopump Sensor B Failed 




0-1 


Word Bit S 

Fuel LSI Sensor A Fall H 




0-1 


Word Bit 8 

Fuel LSI Senaor B Failed 




0-1 


Word Bit 7 

Fuel Turbopump Sensor A Failed 




0-1 


Word Bit 8 

Fuel Turbopianp Sensor B Fa', tod 




0-1 


Word Bit 3 

Alrmotor Speed Sensor A Failed 






Word Bli 10 

Air motor Speed Sensor B Failed 






111001 

Valve Position 8 

80 

30 

SO 



Word Bit 1 

Pre burner Oxidizer Sensor A Failed 




0-1 


Word Bit 2 

Preburner Oxidizer Senaor B Failed 




0-1 


Word Bit 3 

Main Chamber Oxidizer Senaor A Failed 




0-1 


Word Bit 4 

Main Chamber Oxidizer Senaor B Failed 




0-1 


Word Bit 5 

Mala Fuel Sensor A Failed 




0-1 


Word Bit 4 

Main Fuel Sensor B Failed 




0-1 


Word Bit 7 

Trsnspi ration Coolant Sensor A Failed 




0-1 


Word Bit 8 

Transpiration Coolant Senaor B Failed 




0-1 


111010 

Engine System Status 1 8 

80 

30 

SO 



Word Bit 1 

Engine Running an Protection Limit 




0-1 


Word Bit 2 

Engine Control 9yeu-m 1 Failed 




0-1 


Word Bit 3 

Engine Control System 2 Failed 




0-1 


Word Bit 4 

Engine Is Open Loop 




0-1 


Word Bit S 

Engine Brady To Load 




0-1 


Word Bit 8 

Engine Brady To Start 




0-1 


Word Bit 7 

Ignition Spark Bate OK 




0-1 


Word Bit 8 

OM DC Power Duo Filin) 




0-1 


Word Bit 9 

AC tower Bus 1 Failed 




0-1 


Wert) Ml It 

AC Power Bue 1 Filled 




0-1 



( 

Table III-2. Communication Word Repertoire (Continued) 


Word Numoer 

Data Word 

Sample 

Rate 

Data 

Bit 

Rate 

Ls 

< 

Overbead 

Bit 

Rate 

Range 

Data Scaling 
(Bit Resolution) 

111011 

Engine System Statue 2 

5 

90 

30 

20 



Word Bit 1 

Fuel Valve Drive Syatem Failed 





0-1 


Word Bit 2 

Transpiration Coolant Valve Drive 
Syatem Failed 





0-1 


Word Bit 3 

Preburner Oxidizer Valve Drive 
Syatem Failed 





0-1 


Word Bit 4 

Main Burner Oxidizer Drive System Failed 





0-1 


Word Bit 5 

Fuel LSI Cavitation F rotectlor. Lost 





•-1 


Word Bit 6 

Oxidizer LSI Cavitation Protection Lost 




• 

0-1 


Word Bit 7 

Fuel Pump Over speed Protection Lost 





0-1 


Word Bit 8 

Oxidizer Pump Overspeed Protection Loot 





0-1 


WOrd Bit 9 

Preburner Overtemperature Protection Loot 





0-1 


111100 

Engine Commands 1 

25 

250 

ISO 

100 



Word Bit 1 

Oxidizer Blowdown Command 





0-1 


Word Bit 2 

Fuel Blowdown Command 





O-l 


WOrd Bit 3 

Oxidizer Dump Command 





0-1 


Word Bit 4 

Fuel Dump Command 





0-1 


Word Bit 5 

Igniter Check Command 





0-1 


Word Bit 6 

Memory Dump Command 





0-1 


Won Bit 7 

ISI Pump Soin-up Command 





•-1 


Word Bit 8 

Start Command 





0-1 


Word Bit 9 

High Power Pumj '-up Command 





0-1 


Word Bit 10 

Oxldzer Reel rcula Don Pumps On 





k -1 


111101 

Engine Commands 2 

25 

250 

ISO 

100 



WOrd Bit 1 

Shutdown Command 





0-1 


Word Bit 2 

Abort Override Command 





0-1 


Word Bit 3 

Active Ground Check Authority 





0-1 

t 

Word Bit 4 

Fuel Recirculation Command 





0-1 


Word ait 5 

Oxidizer Recirculation Command 





0-1 


WOrd Bit 6 

Nozzle Position Command 





0-1 


WOrd Bit 7 

ECU No. 1 Only Command 





• 0-1 


Word Bit 8 

ECU No. 2 Only Command 





0-1 


Word Bit 9 

Fuel Recirculation Pumps On 





0-1 

• 

111110 

Thrust Command 

25 

250 

150 

100 

5. 5-0.5 

0.000977 

min 

Mixtu'e Ratio Command 

25 

250 

* ISO 

ICO 

0-109% 

0. 106% 


O. MULTIPLEXER SYSTEM 

Figure III-15 is a block diagram of the multiplexer. The interface circuits 
connect the multiplexer to the vehicle multiplex bus, and transform the 
0 to + 5 vdc multiplex signal level to the lOv peak-to-peak level of the vehicle 
multiplex bus. The timing and data decoder and encoder converts received 
Manchester code to binary data, and transmitted binary data to Manchester code. 
The binary data are stored in the Input/Output (I/O) register, where incoming words 
are checked for odd parity (parity check) and outgoing words have an odd parity 
bit added (parity generator). The initializer sets the I/O register when power 
is turned on. The bit counter receives the data clock pulses, and, if the 
number accumulated by the control counter equals the word length, a word 
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length correct signal is produced. After a word length correct signal is gen- 
erated, a received word is transferred from the I/O register to either the 
control word 1 register, the control word 2 register, or the data word 
register, as dictated by the word identification bits of the received word. 

When data are placed in the control word 1 register, the identification 
comparators examine the word to determine if the engine system has been 
addressed, if the multiplexer's engine has teen called, and if a specific 
computer on the engine has been designated. If the multiplexer's engine is 
selected and the multiplexer's computer is either dominant or has been design 
designated, the identification comparators will enable the control word 2 
register ar,d the data word register. 

When data are supplied to the control word 2 register, the first word 
bits are in erted in the word counter and 1 .he last word bits are routed to the 
block comparator. The word length correct signals from the bit counter are 
used to advance the word counter until the word counter exceeds the last word 
input to the block comparator. At this point, the biock comparator signals 
that all words have either been received or transmitted, and the multiplexer 
resumes a passive state until another control word 1 is received. 

Every data word received or transmitted by the multiplexer is either 
placed in or extracted from the compute : memory via a direct memory access 
capability. The direct memory access feature steps the processor for one 
memory cycle to allow access to a location in memory. 

* Each time the multiplexer is to transmit data, a direct memory access 
operation must be performed to read the; data words from memory. Figure 
HT-16 shows the timing to read the first data word, and figure HI-17 indicates 
the'Sequence for subsequent words. Ii he data in the control word 1 register 
calls ior a transmission, the read/ writ 2 control logic generates the DMAREQ 
signal and raises the direction line. The next action is initiated by reception 
of Cortrol word 2. The time between the reception of control word 1 and 
control word 2 is used to stop the computer processor and prepare for ihe 
memory access. With the processor stopped, the reception of control word 
2 causes the read/write control logic to issue the address ready signal. The 
processor responds with the DMAADR signal, which resets the DMAREQ and 
address ready signals and allows the address gating to place the data word 
memory address c the CPU I/O interface bus. The address originates from 
control word 2 via the word counter. The processor reads the address and 
removes the DMAADR signal, which is replaced by the DMADAT signal from 
the processor. This signal announces that the data word is on the CPU I/O 
interface bus, and the data word is seit to the I/O register through the read 
data registei. The direct memory access operation, which requires 2 
microseconds, is complete, and the data word is serially moved from the I/O 
register onto the vehicle multiplexer bus. While data word 1 is being sent, 
data word 2 is called from memory as shown in figure III —17. The difference 
between figure IIi-17 and figure III— 1C> is that the DMAREQ and address ready 
signals are issued simultaneously. The interval, t, represents the time 
inquired to stop the processor (3 /usee max). The remainder of the operation 
follows the sequence described previously. 


? 

to 

to 




CPU I/O Interface Bos 


Figure III-15. Multiplex System Diagram 
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Figure III- 17. DM^ Read Timing Sequence FD 52638 

Consequently, as the first data word is transmitted, the second data 
word is read from memory, and as the second data word is sent, the third 
data word is read from memory. This sequence continues until the end of 
the data block is reached. The computer operates normally between the 
direct memory access cycles. 

When the multiplexer receives data words from the vehicle, a direct 
memory access operation must be performed to write the data word into the 
processor memory. Figures m-18 shows the timing for a write sequence. 
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When a data word is transferred from the I/O register to the data word 
register, the read/ write control logic simultaneously issues the DMAREQ 
and address ready signals, and lowers the direction line provided the word 
number comparator shows agreement between the data word address and 
the word counter. When the processor stops after time interval t (3 n sec max) 
the DMAADR signal is sent from the processor to the multiplexer address 
gating. This signal resets the DMAREQ and address ready signals, and 
allows - the address gating to place the data word memory address on the 
CPU I/O interface bus. The address is taken from the word counter. The 
processor reads the address and removes the DMAADR signal, which is 
replaced by the DMADAT signal from the processor. The signal causes 
the write data gating to place the data from the data word register onto the 
CPU I/O interface bus. The processor reads the data and removes the DMADAT 
signal, which completes the direct memory access operation. A direct memory 
access cycle is performed for each data word received by the multiplexer 
until the end of the word block is reached. 



P. ~ A MAJOR PORTION OF THE HARDWARE IN THE ECU IS DEVOTED 
TO THE- I/O SECTION . ; 


Extensive I/O capability is required to accomplish the various functions 
of signal conditioning, multiplexing, conversion, scaling, and control. Careful 
consideration was given to circuit design to achieve the important goals of high 
reliability and nigh accuracy in extreme ambient conditions with a minimum 
amount of circuitry. Special attention was devoted to such circuit factors 
as low level multiplexing techniques, compensation techniques, common-mode 
noise rejection, and monitoring techniques. Relevant circuit experience 
with a direct bearing on the Space Shuttle engine control was obtained on such 
previous programs as the B1 and F15 programs. A block diagram of the I/O 
interface is shown in figure III— ID. All functional blocks are repeated ior 
dual redundancy in order to meet the fail-op, fail-safe criterion. 
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1. Input Interface Circuits 

i 

Basically, the input interface section may be divided into the following 
subsections: signal conditioning circuits, differential multiplexer, scaling 
amplifiers, monoline multiplexer, and analog-to-digital converter. 

2. Signal Conditioning Circuits 

The signal conditioning circuits process the input sensor signals 
into usable dc voltages. 

a. Speed Circuit 

. The speed circuit converts the change in impedance of the eddy current 
sensor into pulses that are further processed by digital circuitry for direct 
entry into the CPU. The detailed circuit schematic is shown in s ubcontr actor - 
supplied drawing No. 1993611. (All subcontractor-supplied drawings referenced 
in this volume are contained in PWA FR-4377, i.e. , ECU 550K Drawings, 
DVSNo. 26.) 

A 200 KHz buffered Colpitts oscillator feeds into both a reference de- 
modulator and all the primary eddy current sensors. A resistor in series 
with each sensor will vary its voltage drop when a turbine blade passes by 
the sensor. This change in voltage across the resistor is detected by a 
signal demodulator and filter comprised of two LM101A operational amplifiers 
and converted into a dc signal. This dc signal is then compared with the 
reference demodulator signal by means of a high speed comparator (U’Jlll). 
Since the ratio of the reference and signal demodulator output voltages are 
compared, any variation in the amplitude of the oscillator output is effectively 
cancelled. The output of the comparatoi produces corresponding blade pulses 
which are counted and processed by digital circuitry. 

Continuous monitoring of each sensor and the majority of the signal 
conditioning circuitry is accomplished without any additional hardware by 
examining the output signal of each signal demodulator. This signal is 
normally at either of two dc levels , and if this signal is above or below this 
operating range then a failure has occurred in the sensor or signal conditioning 
circuitry and the redundant sensor channel takes over control. 

b. Low Temperature Circuit 

This circuit converts the change of resistance of a platinum resistance 
sensor into a dc signal voltage by means of a bridge circuit. This low level 
signal is then multiplexed by a diffei'ential low level multiplexer as shown in 
subcontractor-supplied drawing No. 1993610. To compensate for small 
leakage currents in the multiplexer switches, a leakage correction resistor 
simulates the source resistance of the bridge and produces a correction signal 
that is converted into a digital value. This digital value is subtracted from the 
measured value by the CPU to obtain the true parameter value. 

During ground checkout when the cryogenic sensor is at room temperature, 
the bridge output voltage is relatively high and will normally structure the 
scaling amplifier. 
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However, by introducing a bucking dc voltage at the input of the scaling 
amplifier, it will remain in the linear region. In this manner, the low 
temperature sensor can be monitored at a room temperature ambient 
during preflight checkout. 

c. Pressure Circuit 

•The pressure signal is created by an active bridge circuit enclosed 
within the transducer housing. This low level signal is also processed by the 
differential low level multiplexer as shown in subcontractor-supplied 
drawing No. 1993617. 

Monitoring of this signal during preflight checkout is accomplished 
in a manner similar to that described for the low temperature sensor. 

d. High Temperature Circuits 

These circuits amplify low level thermocouple signals for further 
processing by a high level monoline multiplexer. The amplifiers are 
chopper-stabilized to reduce drift and increase accuracy. Cold junction 
compensation is accomplished digitally. 

The conventional approach to reference junction compensation of 
thermocouples in aerospace applications requires a calibrated bridge circuit 
and a floating reference power supply. When several thermocouple signals 
must be multiplexed and digitized, as in this application, such a conventional 
approach would consume more power, be more costly, require more hardware, 
and have a lower MTBF . 

The preferred approach for thermocouple compensation utilizes a 
different scheme, shown in subcontractor-supplied drawing No. 1993603, 
where compensation is accomplished after digitizing. A major advantage of 
this approach is that only one isothermal box is required for all thermocouple 
inputs with a resultant reduction in power and cost. 

The thermocouple wires are routed into a remote junction box maintained 
at a uniform temperature (isothermal) and are connected to copper terminals. 

Copper wires then carry the signals to the computer. Each pair of terminals 
in the junction box from the reference junction for the corresponding 
thermocouple circuit. 

In this approach, the reference junction compensation is done in 
temperature units, instead of analog processing of millivolts. Basically, the 
reference junction temperature is measured by a resistance detector (piatinum 
resistance thermometer) and its signal is converted by an A/D converter 
directly to temperature units and stored digitally in the computer’s memory. 

Then, after one of the measurement thermocouples has been scanned by the 
multiplexer, its signal is also converted to temperature units relative to the 
reference junction. 

Logic circuitry in the digital computer then adds these two values 
algebraically, yielding the actual measured temperature which is further 
processed by the computer. The nonlinear characteristic of the thermocouples 

III— 27 



i *31 1 


are automatically compensated by programing the CPU with corrected scale 
factors. Monitoring of the measuring junctions can be done at room tempera- 
ture since the reference junctions will be preheated to obtain monitoring 
signals during preflight checkout. 

In summary, the digital computer’s logic and memory automatically 
accomplishes the reference junction compensation of a group of thermocouples 
to provide the actual measured temperatures. When the next data scanning 
cycle starts , the reference junction temperature (isothermal box) is measured, 
converted, and stored in the computer's memory which is used for the rest of 
the multichannel scan period. 


e. Vibration Circuit 

Electrical charges produced by vibrations acting on a piezo-electric 
transducer crystal are amplified by a charge amplifier and converted to an 
average dc signal by a demodulator as shown in subcontractor-supplied 
drawing No. 1993601. 

Monitoring of the sensor during preflight checkout is accomplished 
by inducing small vibrations into the sensor by an energized auxiliary crystal 
mounted close to the sensor crystal. 


The charge amplifier is a high-gain voltage amplifier with negat've 
capacitance feedback. In operation, the output voltage , which occurs as 
a result of a charge input signal, is returned through the feedback capacitor 
to the input in an orientation that maintains the voltage at the input at, or very 
close to, zero. Thus, the charge input is stored in the feedback capacitor, 
producing a voltage across it which is equal to the value of the charge input 
divided by the cpacitance of the feedback capacitor. This voltage across the 
feedback capacitor determines the relationship between the output voltage and 
the input charge. The transfer characteristic of the charge converter depends 
only on the value of the feedback capacitor. 

A charge converter is a device which possesses a complex input 

impedance, which includes a dynamic capacitive component so large 
that the effect of varying input cable capacitance is swamped out. Thus, 
large variations are possible without any appreciable effect on the overall 
system sensitivity. 


3. Differential Multiplexer 

To minimize the number of scaling amplifiers for the low- temperature 
and pressure channels, a means of low-level multiplexing is utilized with a 
large saving in circuit hardware. This is accomplished by a differential 
multiplexer using integrated MOS-FET switches (RS-1000) and shielded input 
leads. A typical circuit connection is shown in the low temperature schematic 
subcontractor-supplied drawing. No. 1993610. 


4. Scaling Amplifiers 

The output of the differential multiplexer is amplified to the required 
level by scaling amplifiers having high slewing speeds and low drift. A 
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typical circuit is shown in .the low pcrationai amplifiers are 
supplied drawing No^ 1^93610^e h J ng a common-mode rejection 

SS’nS iiftSS lor this amplifier is 0.5pv/“C and slewtng rate 
6 M volts/sec for a gain of 1000. 

5. Monoline Multiplexer 

This multiplexer feeds all high level stptaU Erectly into ‘ ^ (he desired 

converter. It is addressed by a ^*1 ™ j™ u bcontractor-supplied 

channel for processing W the A/D integrated MOS-FET snitches 

S." package^contains 16 channels and may be connected in 
a chain to multiplex any number of channels. 


6. - Analog -to-Digital Converter 

a vnoo 19 hit resolution to allow for conversion and 

The A/D converter will ^ ^ a successive approximation 

^OTverte^s^shOTm^n^ubcontractor-snpplie^drairing No. 13636X3. 

' aIly nat e "Is o^^^aUy^g^^a^ed^oUa^s^The generated 

input analog voltage to a senes ^o g: ^ arg equaL Then , the 

Sstung the generated voltage is read out of the converter. 

T . A comparator decides, at each generated voltage level ' "“'h is larger, 
the generated voltage or the input iirst 

^ i£ 

retained in the voltage generator . 

" Twenty-five percent of full -cale E ^ r ‘=j“tstoger input . 

Z Comparator coZlndTthe converter-, logic to remove the 35% step and add 
the next smaller step, which is 12. 5%. 

logic gating, a programer, butter register, auai & 
network, and voltage reference supply. 

The orocramer drives a D/A converter consisting of the buffer register, 
switches represent theremainder of the bitssc^caao^mioi Mg J tQ 

-Bit (LSD). During operation of the converter , a trial 
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see whether it is larger than the quantity which is to be converted. The switching 
in the D/A converter is decided by comparing the unknown input analog voltage 
against the precise analog output of the D/A converter by means of the comparator 
and logic gating. If the input is larger than the MSB, then the buffer register 
indicates a "l" and the next MSB is tried; if it is smaller than the MSB, the 
register shows a "O" and the next MSB is sampled. 

Consequently, decisions are made successively, each dependent on the 
previous ones where the input quantity is compared to a summation of the results 
of the previous trials until the LSB decision is made. The output digital word, 
representing the input analog quantity is then presented on the individual flip- 
flops of the buffer register. 

7. Output Interface Circuits 

The output interface section is divided into the following subsections: 
digital-to-analog converter, servo control, solenoid control, and ignition control. 

a. Digital-to-Analog Converter 

A schematic of a 12 bit D/A converter utilizing current mode switching is 
shown in subcontractor-supplied drawing No. 1993616. The hybrid microcircuits 
containing the analog switches and resistor ladder network are identical to those 
used in the A/D converter. 

Essentially, a D/A converter is a decoding device that accepts a digital 
signal, D, and an analog reference, R, as inputs, and generates an analog output, 
A, which is related to these inputs by the equation, A = RD. The digital number 
represented by D is always smaller than unity. Therefore, D can be represented 
as: 

r _ D = sl 1 2 _1 + a 2 2 -2 + ....+ a n 2" n . 

The output of the D/A converter is then: -r. 

A = R a 1 2 _1 + a 2 2“ 2 +....+ a n 2 _n 

which is the basic transfer function for any D/A converter. 

Although many D/A techniques exist, the selected approach is the parallel 
resisior-ladder type because of excellent speed and accuracy characteristics. 

The digital output from the CPU is stored in the buffer register consisting 
of 12 flip-flops which, in turn, activate 12 analog switches. Each analog switch 
then connects a reference voltage or a ground to the resistor network. The 
resistor network converts the voltage into a curr ent of specific magnitude, which 
is summed with other currents generated by the other switches and resistors. 
This resistor ladder network contains binary weighted resistor valves. An 
important characteristic of this network is that a current caused by turning on 
one of the analog switches is halved every time it flows through a node. 

-X— - , . 
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Since a common reference voltage supply will be used 1 for both input and 
° . .. __ raffapto of temperature variations on ttie reierence 

output interface sections, fore ^ accuracy of the D/A converter will be 

l3edTo ± 1/2 LSB crrir due to quantization, plus ±1 LSB error due to the 
ladder^ network , ^ ana l// s wi tc hes , "and buffer amplifier, or a total error of about 

±1-1/2 LSB. 
b. S.ervo Control 

This circuit will consist of a signal amplifier, a power amplifier, and 
servo compensation networks for driving a brushless dc torque motor. In add.- 
tion, power bias switches are provided for monitoring purposes. 

ThP electronic circuitry for controlling the dc servo is shown in 

addition, it possesses high efficiency and minimized heat generation. 

The dc sienal is first applied to an operational amplifier in a differential 
mode configuration. This amplifier also provides the major portion of the gain 

in the servo loop. 

- The next two st ages provide the required amount of servo compensation 
tional amplifiers. 

rrr~ The output stage is in a Class B, push-pull, complementary, emitter- 
follower configuration, The advantages of this configuration are high efficiency, 
high power capability, and a minimum number of components. 

The servos controlling the actuator valves will utilize brushless dc torque 
motors The major advantages of these servos are the elimination of gear trains, 
a wide servo bandwidth, and low power dissipation at null. 

Tim simplicity of the brushless dc torque motor depends upon the high 
energy permanent magnet rotor, which has either two or four poles depending 
. j mtnHnp angle The rotor turns within a toroidal coil assembly 
°o? co°nper wire ^nd^arotd an iron Hng and encapsulated in tough plastic Such 
" , crvannih <stpn free toraue because commutators and brushes are 

~teT since there iTno SKtSSTor mechanical contact between the rotor 
and stator ’ radio noise and mechanical wear are also eliminated. Power is con- 
sume/ordy when torque is dcUvered, tvhich results in high electrical efficiency. 

' The dc motor coil is monitored for open or short circuits by examining the 
voltage across a series resistor which also functions as part of a current feed- 
back circuit In addition, the gain of the servo amplifier is monitored by 
examining the input and output analog voltages, which arc converted to digital 
values by the A/D converter and processed by the Cl U. 

c. Solenoid Control 

Tfp't-,? . 

T ’ Both latch and hold coils are provided with corresponding switching cir- 
cuitry to reduce power consumption of the 11 solenoids during steady-state 
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conditions. A schematic of the control circuit is shown in subcontractor - 
supplied drawing No. 1993607. 

' - ■ - a digital latch signal initially energizes the solenoid with full powder for 
about 100 milliseconds. After latching, a hold signal reduces current in the 
solenoid with r. corresponding reduction in power. A ground switch is provided 
to eliminate the effect of a single point failure in the control switches. 

The integrity of the solenoid coil is checked by a small monitoring current 
through the coil, which is detected by a series resistor during ground checkout. 

The position of the solenoid armature is monitored continuously by means 
of two magnetic proximity sensors. These dual sensors are energized by a 
5-KHz frequency applied to their excitation coils. The output signals of the 
corresponding sensor coils are amplified, demodulated, and filtered for further 
processing and storage by the CPU. 

d. Ignition Control 

The engine ignition system, consisting of four identical exciter/spark plug 
units provides redundant control for the engine preburner and main chamber 
ignition. Power is supplied to each exciter from redundant 115- volt, 400-KHz 
power courses. Upon receipt of a start command, a digital "Ignition On" is 
applied to the control logic as indicated in subcontractor- supplied drawing 
No. j. 993609. enabling a signal from the transformer coupled zero-crossing 
.detector. The zero-crossing detector pulses the triac gate control circuit at 
half cycle intervals applying 115-volt, 400-Hz power to the exciter. Removal 
of the "Ignition On" signal terminates power to the load. 

Q CAREFUL SELECTION AND APPLICATION OF PIECE PARTS TYPES 

IMPROVES THE INHERENT RELIABILITY' OF THE DESIGN. 

A survey of candidate parts was accomplished in Phase B. (Refer to 
r Avionics Trade Snidies, PWA FR-4439. ) The digital circuits chosen are 
^transistor-transistor logic where type 5400 is selected for the elementary 
logic and type 9300 for the complex arrays. A survey and selection of parts - 
for the three memory types used was also made. (Refer to Avionics Trade 
Studies, PWA FR-4439). A Metal-Oxide Silicon (MOS) memory provides (he 
best reliability with the smallest size and weight for the 8k word permanent 
memory requirements. ECU flexibility and ground trim capability will be 
achieved by a plug-in memory module of 320 words using bipolar logic with 
“field programable elements. This memory will provide trimming capability 
of the engine characteristics. High speed read/write capability for the scratch 
pad memory will be provided by high density 25G-bit packages. 

High reliability at the part level also requires stringent quality 
assurance proceduies. The P&WA Quality Assurance Department nas 
"reviewed the subcontractor's control procedures and will remain close liason 
•during Phase C/D to further ensure that design verification is augmented with 
a high level of reproducibility. 

The following paragraphs discuss the digital circuit requirements, types 
of circuits considered for selection, and the factors leading to the optimum 
choice. 
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A study of digital circuits; selec ^“" ^ ^s “comprehensive review of 
Studies PWA FR-4439). This report t'ocumen ine con irol computer 

commercially available circuits ‘mo^Umportant environmental considerations 
on the Space Shuttle engine. The most l^f ^ miUtary temperature range 
are that the devices must opcia .motion on the engine in the presence 

(-55”to * 12 r j°C). and the co ' npul ®' . mU certain groups of logic gates, MSI logic 
of high vibration and acoustic not lnv estigated, and likely 

candidates a , n n d eIch'°ar S ea were identified. TTL 

b ™"s family of 5 c^ircuits'provUies the 'switching speed, flexibility, and wide 
availability required in the computer design. 

Bipolar random access 

Will be used only for the sraalU mem0 I rieS o{ the read only type were found 
high density are essentia . retention, small size and weight, 

alid cornpalibillty^dm ^^^mg'sl^words 'ofHalterab!^ 

‘ S reqUir6d a " d fOT inCreaS6d 
t r\wj rn ST AND 


R. 


ise paraiuctciP - 

M.OS MEMORY IS OF HIGH RELIABILITY, LOW COST, AND 

high speed 




~ The MOS memory provides excellent data Retention, 

®Se7 A plafed 4 rrL', dmde' and bipolar Integrated etrcuits, MOSFET 
integrated circuits, and wire brai . 

, 4 j iiu rP c nP( .t to the following major 

Each candidate was evaluated with respect to 

parameters: 

Retention of stored data 
Size and weight 
Reliability 
Cost and availability 
Power consumption 


Environmental conditions. 


% r>nvii — 

Circuits of moderate complexHy^^ explored, 

to minimize size and weight, an s e i or more of the logic functions 

Each manufacturer otters ^^^VJlnVegrated devices were studied as a 
needed by the computer. Large scaie 0 
means of implementing he computer memory. 

circmiu e bm^%o°Cd’n .gT/mTr'e^^^ 
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are predominatly digital. The selected circuits meet the design requirements 
in these functional areas. 

• Central Processing Unit 

Arithmetic Unit 
Control Unit 
Memory Unit 

• CPU Interface Controllers 

D/A Converters 
Speed Inputs 
A/D Converters 
Discrete Outputs 
Discrete Inputs 
Data Bus Inputs 

• Speed Measurement Circuits 

Main Fuel Turbopump Speed 

Fuel LSI Speed 

LOX LSI Speed 

Main LOX Turbopump Speed 

• Communications With Vehicle 

~ Transmission Line Circuits 
Data Format Control Circuits 
Error Detection Circuits 
Scratch Pad Memory 

• p: Second sources for the integrated circuits are not Lsted in the circuit 
survey, but this is considered in the selection of the devices. Devices which 
are NASA approved, have been so identified with this information being obtained 
from MSFC-85M027 06 and MSFC-85M02716. The future availability of each 
device was estimated by judging whether it is an industry standard or provides 
a basic function with wide applicability. In either case, future availability is 
considered likely. 

In the listing of representative logic devices, emitter coupled devices are 
included for comparison purposes, but the low noise immunity and high power 
consumption tend to discourage use of this type device. In general, high speed, 
unless required, is not desirable due to the noise and power supply problems 
produced by this type logic. High speed TTL was rejected, since the speed of 
normal TTL is adequate and the power consumed is greater than that required 
by normal TTL logic. Consequently, the most acceptable families are the 
basic TTL and DTL microcircuits. These units exhibit satisfactory speed, 
reasonable power consumption, and wide availability. 

a. Selecting one family over another is difficult; however, since bipolar 
MSI and LSI devices are basically TTL, TTL logic has the advantage of 
minimizing interface problems (loading, voltage levels, and ringing). Many 
manufacturers offer TTL families, but Texas Instruments' 5400 family is an 
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industrial standard and is NASA approved. Therefore, the TTL logic (5400) 
is the prime candidate for Space Shuttle logic. 

A few manufacturers supply MOS logic, but National Semiconductor's 
(MM400) family is not extensive, is relatively slow, and does not interface 
directly with TTL. While the speed may initially appear acceptable, it is 
generally inadequate since several stages of logic are usually needed and 
the signal propagation delays are additive. In addition, commercial 
manufacturers appear to be expending little effort in this area. One exception 
is RCA's COS/MOS series where considerable activity is evident. However, 
the present level of this technology is significantly below the level attained by 
TTL. Also, interfacing with other types of logic requires special circuits. 
Consequently, MOS logic was rejected. 

The use of MSI circuits to reduce size and weight is mandatory for this 
application. Unfortunately, while many MSI circuits are available, there is 
little uniformity between devices of different manufacturers. Many MOS MSI 
devices are available, but these units suffer from the same compatibility 
drawbacks as basic MOS logic. Consequently, standard TTL MSI micro- 
circuits, such as the 9300 series, will be used whenever possible. Devices 
were selected by determining the function required and then choosing a 
reputable source. (Refer to Avionics Trade Studies, PWA FR-4439). 

rhe feasibility of using low power transistor transistor logic in the 
computer central processing was investigated. The advent of low power TTL 
devices, including MSI functions, raises the possibility of a package replace- 
ment of regular TTL logic with a net power savings. However, operating 

delays^ Sacrificed since the low powe: ’ TTL devices have longer propagation 


In addition, the low power circuits cannot fie directly substituted in most 
cases t and the extra delay of these circuits proh bits their use even though the 
functions are available. With minor ch mges in die design, approximately 70% 
Y the computer could be implemented with low power TTL while retaining the 
l-imc-rosecond time cycle, and the power savings would approximate 50%. 

JJse of low power logic is not envisioned for the present design, but these 
data are included to highlight the potential qualities of low power TTL. 


Semiconductor memories of LSI-scale complexity are prime contenders 
o implement the computer's memory. For comparison purposes, base 
memory of 8192 words of 18 bits in read-only form and 128 words of 16 bits 
as read/write memory is assumed. A practical memory requires the most 
complex integrated circuits available to minimize the number of packages 
external interconnection paths, and power consumption. Memories are 
presently an extremely active field and improved integrated circuits containin 
more bits and consuming less power are likely. MOS memories have the 
most suitable size and power characteristics, and the TTL interface provided 
on each memory chip ensures compatibility with the remainder of the system 


Jn summary, various ways of implementing the Space Shuttle engine 
control computer were considered. A number of logic families were 
evaluated, and the o400 series and MOS memory types were selected. A 
nEuV. 0 : MSI circuits from a number of manufacturers are suitable for this 


application. The engine control computer design specifies a large (6144 
words) read only memory to provide the operating program and small (128 
words) scratch pad memory to store variables. At this time, a MOS memory 
for the the ROM meets all system requirements with power and cost 
advantages over other types. Further, field programability of MOS memories 
will be practical in the near future to the extent that new chips can be custom 
organized on field equipment without involving the facilities of the original 
manufacturer. 

S. TWO VEHICLE POWER BUSES PERMIT FAIL OPERATIONAL/FAILSAFE 

Power provided by the vehicle will be +28 vdc. The power circuits will 
be dual redundant. 


1 . 


a. 


Electrical Requirements 

Electronic Control and Instrumentation Voltage 


The engine shall start, run, and shutdown safely when dc voltage is 
supplied at the engine/ vehicle interface, meeting the following minimum 
requirements: 

_ • Regulation - ±4 vdc 

• Ripple - ±1 v peak 

• Transients - ±200 volts for less than 50-usec duration 

• Momentary loss of power - less than 250 ms on both buses. 

A maximum of 780 watts is required prior to engine start, 1000 watts 
during all power level modes, and 780 watts f^r 5 seconds following cutoff. 

A maximum of 1000 watts are required for nozzle translation. 

b. Ignition System Voltage 

The engine performs within the requirements of the CEI Specification 
when 115-vrms, 400-Hz ac voltage is supplied at the engine/ vehicle interface, 
meeting the following minimum requirements: 

• Voltage Regulation - ±20 vrms 

• Frequency Regulation - ±40 Hz 


Conforms to MIL-STD-704A 
Less than 50 ms 


• Transients - 

• Momentary loss of 
power - (one of two 
redundant lines) - 

2. Functional Subcomponents 

Two vehicle power buses permit the system to fail operational after a 
single power failure and to failsafe after a second power failure. 
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Both power buses will be available to, and monitored by, both control 
units. This approach eliminates the possibility of losing one control unit 
on all engines due to loss of one power bus. It does impose a requirement to 
avoid a single point failure since both buses are interfaced in both control 
units. The selected approach simultaneously utilizes both power buses through 
isolating diodes and fusing resistors as indicated in figure 131-20. 

This reflects the design philosophy of keeping all control system 
redundancy fully active with no standby elements. 

The power supply contains three sections: 

1. CPU Power Supply - provides power for the CPU as well as 
the various analog circuits and outpat devices. 

2. Signal Conditioning Power Supply - provides power to the 
sensors and signal conditioning circuits independent of 
failures in the CPU. In the event of a CPU failure, 
sensor signals are still transmitted to the redundant 
computer. 

3. Checker Power Supply - a low current 5-volt supply used 
to ensure operation of the checker monitor functions 
despite failures in the CPU or signal conditioning supplies. 

Redundant 28 -volt power sources are applied to each power supply 
through fusing resistors and dual series diodes. The failure mode ami the 
resulting effect of a single point failure on the system for these components 
are summarized in table III-3. Also considered is the effect of power loss 
and a short circuit to ground in the power supply. 

Trade studies were made on the choice of ac or dc power (+28 vdc, 

-120 vdc, 115 vac). Weighting factors were solenoid compatability, weight 
and size of conversion circuitry, cost, circuit complexity, EMI suppression, 
and redundant bus circuitry. The most logical choice for primary power was 
found to be 28 vdc (Refer to Avionics Trade Studies, PWA P'R-4439). 

The 28-volt power bus energizes power supply regulators as indicated 
on subc on tractor -supplied drawing No. 1993615. A summary of the circuit 
diagrams and functions for each power supply is given in Table ID-4. The 
pcwer supply basically consists of a 15 to 30-KIIz dc to ac converter which 
drives combinations of linear and switching regulators. The positive voltage 
switching regulators are excited directly from the 28-volt isolated bus. 

Switching is used to provide high efficiency and small filtering components. 

Since switching regulators are well known sources of EMI, inductive- 
capacitive type filtering will be employed on all input and output lines to 
minimize EMI effects on the CPU and external avionics. Shielded enclosures 
will also be utilized as required to meet the provisions of Mii-Std-461. 
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Table III-3. Failure Mode Effects On Diodes and Resistors 


Element 

Failure Condition 

Effect on System 

Diode 

Open 

None - Redundant 
System 

Diode 

Short 

None 

Resistor 

Open 

None - Redundant 
System 

Resistor 

Short 

None 



Short Circuit to 
ground on power 
supply input. 

None - Fusing 
resistor opens- 
redundant system 

- 

Loss of power - 
one bus 

None - second bus 
supplies required 
power 

Table III- 

-4. Power Supply Functions 


Power 

Supply 

Schematic 
(Subcontractor- 
Supplied Drawing 
No.) 

Func tion 



-13 V±3% - 

1993662 

CPU Analog Supply - 
Analog Control 

' +13 V±3% 

1993608 

CPU Power Supply - 
Analog Control 

+5 V±19% 

1993606 

CPU Power Supply - 
Digital Computer 

+5 VrfclO^- 

1993606 

CPU Power Supply - 
Digital Computer 

-13 Vi3% 

1993664 

Signal Conditioning 
Power Supply - 
Conditioning Circuits 

+13 V±3% 

1993663 

Signal Condi ioning 
Power Supply - 
Conditioning Circuits 



/ 


Table III-4. Power Supply Functions (Continued) 




Schematic 



(Subcontracto r- 


Power 

Supplied Drawing 


Supply 

No.) 

Function 

+10 V±0. 05% 

1993620 

Signal Conditioning 
Power Supply - Sensor 
Excitation and Conversion 



Reference 

+5 V±10% 

1993606 

Checker Power Supply 


The switching mode voltage regulator offers the advantage of high 
efficiency over the more common series or shunt regulation schemes. 

This particularly apparent when a large difference exists between the input 
voltage and the regulated output voltage. Consider a voltage regulator with 
28 volts input and an output of 5 volts at one ampere. A conventional series 
regulator would require a drop of 23 volts across the pass transistor. Thus, 

23 watts would be wasted, and the efticiency would be only 187o. Switching 
regulators, however, can be simply designed to give efficiencies greater than 
75% under the same input and output restrictions. As with series regulators, 
greater efficiencies can be realized when there is less of a difference between 
input and output voltages. 

A simplified operation of the switching regulator is shown in figure III-21 
The switch transistor, Q]_, is operated only in saturation or in cut off so that 
power dissipation is kept to a minimum. Diode CRj^ conducts during the time 
that Qi Is cut off, thus maintaining current flow in inductor L2. 

When Q x is turned on, CRi is reverse biased and does not conouct. 

The current in L 2 will increase linearly according to the relation. 

t AiL 

E . — E . — L 0 ■ • 

^ in out 2 

ton 

When the output voltage reaches the reference voltage, determined by 
R3 and R9, the regulating amplifier, ARi turns off Qj. 

This current flows in the load, and charges capacitor Ce. As the 
inductor current falls below the load current, the output capacitor will start 
to discharge and E out wall decrease.- When E ou t falls to a level slightlj. less 
than the reference voltage, the error amplifier turns Qj back on and the cycle 
repeats. The output from the regulator ripples above and below at dc level 
set by reference. 
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CENTRAL PROCESSOR UNIT 


The Central Processor Unit consists of an arithmetic and control unit 
and three memories. A block diagram of the proposed configuration is shown 
in figure III— 22. The performance characteristics of the CPU are summarized 
as follows: 


Word length 
Speed 


Memory 


16 bits 

1. 0-MHz clock 
4. 0-juisec add 'ime 
19. 0-/zsec multiply time 

6144 words MOS permanent memory 
256 words scratch pad memory 
512 half-words field programable 
permanent memory 


Interrupts 


3 internal interrupts 
1 I/O interrupt. 



Figure III-22. Central Processor Unit Diagram FD 52614 

The memory is organized as three independent memories communicating 
with the processor via a common memory bus. Additional memories can be 
added to the bus as required. The three memories are described in 
paragraphs a, b, and c. 

1. MOS Permanent Memory 

A 6144 x 16 permanent memory is used to store the operational program, 
as well as constant data and tables. A MOS memory is used for this function 
due to its very small size and low cost. The advantage of this type memory 
is that its contents are completely invulnerable to accidental changes. It is 
similar in design to the MOS memories currently in use with the Bendix-900 
computers in the S3A aircraft data computer, the S3A flight control 
computer, and the CPU-46 altitude reporting computer. 






Pratt & Whitney Rircraft 
PWA FR-4249 
Volume II 


2. Field Programable Memory 

Since changes in certain parts of the tables and constant data are 
inevitable in any development program, a 512 word x 16 field-prog ramable 
memory is used to store data which may be subject to change. This is a semi- 
conductor memory that uses devices that can be programed directly by the 
user, thereby avoiding the delays inherent in changing the contents of MOS 
memory, yet preserving its permanent characteristics. These devices are 
available from Harris, Inc. , in a 512 -bit configuration. Part of this memory 
is housed in plug-in trim module that is externally accessible. 

3. Scratch Pad Memory - . 

A 256 x 16 scratch pad memory stores such temporary data as the 
intermediate results of computations, subroutine return addresses, etc. 

A semiconductor memory (flip-flop storage) is used for this purpose. This 
is an expanded version of the flip-flop memory which was used on the Bendix- 
800 computer in the P&WA B1 fuel control system. 

The arithmetic and control unit is shown in figure III-23. It is electrically 
identical to the Bendix-800 computer used on the P&WA B1 fuel control, as 
well as the new Pershing Missiie System guidance and control computer. 

It has a general purpose, full parallel organization using a single address 
per instruction. Arithmetic is performed on binary, fixe point numbers, with 
m itive numbers represented in two's complement form. 

The A, Q, X, D, and P are 16 -bit registers. The A and Q are the 
accumulator and auxiliary accumulator, the X is the index register as well as 
the general storage register, the P is the program counter, and the D register 
is the memory data register. The status register consists of a 2-bit condition 
register, a 5-bit "N” register, and an overflow indicator. The condition 
register is set to indicate whether the results of certain instructions are 
negative, zero, or positive. The "N" register is associated with the shift 
class of instructions. 

Data are routed to a 16-bit, parallel -carry propagation adder via the Y 
and Z multiplexers. Selection of registers as data source depends on control 
signals resulting from instruction decoding in the "I" register. Prior to 
operation by the adder, the data are conditioned by tl.e logic blocks, as 
commanded by the timing and control unit. The output from the adder is gated 
to any described registers by the timing and control unit. The A and Q 
registers have special capabilities for shifting right or left, interchange, and 
logical AND functions. 

4. The Instruction Word Format 

xxxxxxxxx 

Word Address 


Indirect Address Bit 


X X X X 
Op Code 


Index 

Bit 


Page 

Bit 



Adder Exit Bus 


Figure III-23. Arithmetic and Control Unit 



FD 52613 
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The 4 bit operation allows provision for 14 memory reference instructions, 
and the following nom^emory reference instructions: 

• Direct Addressing Capability - The word organization of the CPU 
allows direct addressing to any word on the current page (by setting 
the page bit to 1), or page zero (by setting the page bit to 0), 
where there ar- 512 words per page. By proper organization 
of the program and data areas, the number of out-of-page 

• references can be minimized. 

• Indirect Addressing - Provision for indirect addressing within the 
instruction word allows efficient subroutine linkage, table manipula- 
tion, and out-of-page references. Moreover, through this facility, 
addressing of up to 16K of memory is permitted. Multiple level 
indirect addressing is provided. 

• Index Facility - One 16 -bit register is provided within the central 
processor. Indexing is performed when the index bit is set; however, 
indexing is performed with no time penalty. Indexing provides a 
mechanism for efficient subroutine linkage, counting, and looping. 

Indexing may be combined with indirect addressing to provide pre- 
indexing and post-indexing at any level of indirection, allowing 
efficient programming for certain routines, e. g. , coordinate 
transformation, and vector manipulations. 

5. Interrupt System 

The CPU uses interrupts to the program to inform the CPU of boch external 
events requiring immediate action, and malfunctions of the memory and I/O units. 

When the CPU senses an interrupt request, the presently active instruction 
will be completed and the next instruction's address will be taken from the hard- 
wired interrupt bus. Typically, this instruct!*, will be a JSM instruction, which 
stores the present state of the program counter and transfer control to an 
interrupt routine associated with the particular interrupt. In the event, of 
conflicting interrupt requests, the first one serviced will be Lhe one of highest 
priority which is unmasked; lower priority requests remain in queue waiting 
for service. This interrupt system provides a fast, flexible means of 
responding, in a real time environment, to external asynchronous events which 
require program action. 

The proposed system uses 4 interrupts: 



— 

Level 

Mask 

I/O or CPU 

Power On 

1 

No 

CPU 

External 

2 

No 

I/O 

Illegal Address 

3 

No 

CPU 

Improper I/O 

4 

No 

CPU 
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This is a scaled down version of the interrupt system used on the Pershing 
Missile System guidance computer, which has 16 interrupts, of which 11 are 
maskable. 

6. Memory Reference Class Instructions 

The memory reference instructions and their specifications are listed 
in table III- 5. 

Three 16 bit registers are available for program use, the A, Q, and X 
registers. A and Q form a double length accumulator; X is the index register. 

All instruction times include indexing. 

MULTIPLY and DIVIDE instructions are deliberatley included in hardware. 
The MULTIPLY instruction is universally applicable in scientific problems of 
all types. The DIVIDE instruction provides real-time savings and memory storage 
efficiency in such things as trigonometric computations, linear interpolation, 
averaging, smoothing, etc. 

The JSX instruction, which stores the next instruction's location in the 
index register and transfers to a new place in memory, is convenient for 
subroutine linkage, especially where the program is hard-wired and the JSM 
instruction cannot be used. The JSM instruction which stores the next instruct- 
ion's location in the memory word specified by the instruction and traxsfers 
control to the next cell, is the standard method for transferring control to a 
subroutine. It requires, however, that the start of the subroutine be in variable 
memory. This instruction is also the standard means of transferring control to 
. an interrupt routine, following an interrupt, and remembering the place at 
which interrupt took place. 

The CMP instruction "compares" the accumulator and the specified memory 
cell, "remembers" the state of the difference in the CONDITION register, where 
: it is accessible by the SKIP instructions. No other register is changed by the 
instruction. This instruction is useful in comparing against limits, caecking 
identity of words, etc. 

The AND instruction, from which one can generate, with software, the 
’ -’’exclusive or" and "inclusive or" Boolean operations, allows for both bit and 
: field handling and manipulation. 

7. 1 SKIP Class Instructions 

The SKIP instructions are listed in table III— 6 . 

The CONDITION register is a 2-bit register which "remembers" the 
adder output of the arithemetic instructions in terms of the sign of the result 
and its magnitude. This information is then accessible to the SKIP on condition 
instructions. Overflow out of the adder is also stored and can be tested by the 
SKIP instructions. The instructions which cause a change in the status of the 
CONDITION and OVERFLOW registers are specified in table III-6. 
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Table in-5. Memory Reference Class Instructions 


Instruction 

Description 

Indexible 

Indirectly 

Addressable 

Sets Condition 

Sets Overflow 

o 

0) 

CD 

3 

o 

S 

•H 

Comments 

ADD 

Add memory to A 

Yes 

Yes 

i 

Yes 

Yes 

4 

(A)+(m) A; m is the effective address 

after all indexing and indirection is per- 
formed on the address field of the instruc- 








tion. 

SUB 

Subtract memory from A 

Yes 

Yes 

Yes 

Yes 

4 

(A) -(m) — ► A 

MPY 

Sultiply memory by A 

1 

1 

Yes 

Yes 

No 

No 

19 

(A)x(m) (A, Q); the product is a double 

precision signed quantity. 

DIV 

Divide (A,Q) by memory 

Yes 

Yes 

No 

Yes 

19 

(A,Q)-j- (m) Q; pseudo remainder— ► A. 

The dividend is treated as a double pre- 








cision signed quantity. 

LDA 

Load memory by A 

Yes 

Yes 

Yes 

No 

4 

(m)— ► A 

LDX 

Load memory in X 

No 

Yes 

Yes 

No 

4 

(m) X 

STA 

Store A in memory 

* ( 

Yes 

Yes 

No 

No 

4 

(A)-*-m 

STQ 

Store Q in memory 

Yes 

Yes 

No 

No 

4 

(Q)-*- m 

STX 

Store X in memory 

No 

Yes 

No 

No 

4 

(X)— ► m 

CMP 

Compare A with memory 

Yes 

Yes 

Yes 

Yes 

4 

Form (A)-(m): set CONDITION, and over- 
flow based on this difference. Original 


contents of A, before instruction, remain 
in A. 
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Table Ilk— 5. ' t MemoryRefferenke Class Instructions (Continued) 




Instruction 


Description 


.2 

1 

v 

5 


JS 

^■s 

7 to 
O 03 

2 2 

§ 

1 



"3 

o 

U 

c 

c 

1 

o 

0) 

4 

0) 

• 

►s< 

W 

CO 

-4-> 

A 

s 

p 

Comments 


AND 

"AND" memory to A 

Yes 

Yes 

No 

No 

4 

(A)/\(m) A: "Logical and" of 
accumulator and memory. 

JU 

Jump 

Yes 

Yes 

No 

No 

4 

m P: the effective address of placed 

in P. The next instruction to be executed 
will have address (P). 

JSX 

Store program counter in 
X and Jum;> 

No 

Yes 

No 

No 

4 

(P)+l -► X; m -► P. The address of this 
instruction plus one is stored in X. The 
next instruction comes from P. 

JSM 

Store program counter in 
memory and jump 

No 

Yes 

No 

No 

4 

(P)+l -► m; m+1 — P. The address of 
this instruction, plus one, is stored in the 
effective address. 
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Table Hi-6.' •' Skip Class Instructions 


Instruction 

Description 

Time ( sec) 

(i 


Comments 

SKGT 

Skip if CONDITION greater than 0 

* . 

1 

J 

-2 

• 

, 1* ‘ 

l- 

All conditions (overflows) are determined 
by the last CONDITION (OVERFLOW) 

SKGE 

Skip if CONDITION greater than or 

:• 2 


setting instruction which was executed 

i. i j 1 1 i n 

equal to 0 . ( : 

• i 

. i • 


prior to this one. 

SKEQ 

Skip if CONDITION equal to 0 

2 

2. 

The skip displacement D is specified in the 

I ! 


displacement field of the instruction. 

SKNE 

Skip if CONDITION not equal to 0 

2 


D must be in the range -64 < D<64. If the 
condition or overflow requirement is satis- ■ 

SKLT 

Skip if CONDITION less than 0 

2 


fied (P)+D+l -+► P, where (P) is the contents 
of the instruction counter at start of this 

SKLE 

Skip if CONDITION less than or 
equal to 0 

2 


instruction. The next instruction location 
is determined by the new value of P. If the 
requirement is not met, (P)+l -► P; i-e- * 

SKO 

Skip on overflow 

2 

• 

the next instruction in sequence is executed. 

SKNO 

Skip on no overflow 

2 

3. 

The skip on accumulator instructions 
examine the accumulator value at the start 

SKAGE 

Skip if A greater than or equal to 0 

2 


of the instruction. 

• 

Skip if A less than 0 


4. 

None of these instructions modify the 

SKALT 

2 


CONDITION OR OVERFLOW registers. 

SLSA 

Shift left short algebraic • 

3 + n 


r» 

* 


1 1 
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Since the SKIP field is in either direction from the present value of the 
program counter (up to 64 locations) based on a large number of conditions, 
these SKIP instructions provide a highly versatile testing and branching 
capability. 

8. Shift Class Instructions • 

The Shift Class instructions are as listed in table ni-7. 

The NORMALIZE instructions provide a fast and powerful tool for 
floating point operations, scaling problems, and double precision operations. 

The N register is a 5-bit register which stores the shift count for the 
NORMALIZE instructions, and can be used as a source for the shift count in 
the other SHIFT or ROTATE instructions. The source of the shift count for 
any SHIFT or ROTATE instruction may be the index register, the N register, 
the couni. field of the instruction word, or the first 32 locations in memory. 

The large number of shift class instructions, and the flexibility in speci- 
fying the source of the count, makes this group of instructions useful in a large 
variety of situations involving arithmetic and logical manipulation. 

Register Change Class Instructions 

- The Register Change Class Instructions are as listed in table III-8. The 
instructions provide a variety of microprogramed instructions for inter- 
register operations, sign and overflow manipulation, mode control, etc. These 
instructions avoid, in a great many situations, the necessity of storing inter- 
mediate results in memory, thereby conserving real time and storage space. 

It). Input/Output Class Instructions 

i The I/O Class instructions are as listed in table m-9. The I/O instruc- 
tions are aU of the "request-response'' type; the address of the I/O device must 
be acknowledged by the I/O controller before the processor will transmit or 
receive data. The receipt or transmission of data by the I/O device must be 
^acknowledged" to allow the processor to complete the instruction. This pro- 
vides a consistent and convenient manner to ensure proper functioning of the 
I/O channel, in spite of lengthy bus delays, or delays in the acquisition, 
generation, or acceptance of data. 

The MASK I/O instructions provide a flexible means for reading and con- 
trolling the mask bits of the interrupt interface. Using these instructions, the 
priorities of interrupt levels can be altered easily to suit varying program 
conditions . 


<r\ 


U. DIRECT MEMORY ACCESS INTERFACE 

The Direct Memory Access (DHA) Section of the CPU provides a single, 
hieh speed method of retrieving scratch pad memory information when requested 
by the vehicle computer. The design allows a minimum of CPU control program 
interruption as the data are accessed from the memory. 
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i Table ni-7. Shift Class Instructions 


Instruction 


SLSA 


SLSAX 


SLSAM 


SLSAN 


SRSA 


SR SAX 


SR SAM 


SR SAN 


SLSL 


SLSLX 


Description 


Time (//sec) 


SLSLM 


SLSLN 




Shift left short algebraic 

3 + n 

Shift left short algebraic, 
from X 

* 3 + n 

Shift left short algebraic, 
from memory 

3 + n 

Shift left short algebraic, 
from N 

3 + n 

Shift right short algebraic 

3 + n 

Shift right short algebraic 
from X 

3 + n 

Shift right short algebraic 
from memory 

3 + n 

Shift right short algebraic 
from N 

3 + n 

Shift left short logical 

3 + n 

Shift left short logical, 
from X 

3 + n 

Shift left short logical, ’ 
from memory 

3 + n 

Shift left short logical, 
from N 

3 + n 


Comments 

Short refers in all the shift class instructio ns to the 
contents of the accumulator A. Long refers to the 
double word in A, Q. 

If the shift is logical, the contents of A (or A, Q) 
is treated as 16 (32) bits of logical data. No dis- 
tinction is made for the sign bit of A (or A, Q). 

If the shift is algebraic, the sign bit is preserved 
and the contents of A (or A, Q) are treated as a 
signed number to be multiplied by a power of 2. 

In the case of left algebraic shifts the OVERFLOW 
register will be set when significant bits are lost. 
The condition register is unaffected. 

A count field from 0 to 31 may be specified in the 
instruction. If the shift instruction is of memory 
type (ends in M), this field specifies a memory 
call (from 0 to 31) whose contents specify the 
number of shifts n, to be performed. If the shift 
is literal (does not end in X, M or N), the count 
field itself specifies the number of shifts. If the 
shift is of index type (ends in X), the count field is - 
ignored, and the number of shifts is taken from the 
contents of X. If the shift is of type N (ends in N), 
the count field is again ignored, and the number of 
shifts is taken from the N register. 
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Tible m-7. Shift - Class Instructions (Continued) 

Instruction 

1 — 

’ Description 1 " 

1 | M ' ‘ » 

Time (/xsec) 

, Comments 


Shift right short logical. 

3 + n 

6. In the NORMALIZE instructions, the contents of A 
(or A, Q) are treated as a single (double) precision 
algebraic quantity. The number is shifted left until 

SRSLM 

from memory 


SRSLN 

Shift right short logical, 
from N 

Shift left long algebraic 

3 + n ' 
3 + n 

its magnitude is greater than or equal to 1/2 and 
less than 1, in case the number is positive, or until 
its magnitude is greater than 1/2 and less or equal 
Jo 1 fn case the number is negative. The number 

SLLA 

of required shifts is stored in the N register. 

SLLAX 

Shift left long algebraic, 
from X 

3 + n 


SLLAM 

Shift left long algebraic, 
from memory 

3 +n 

i 

1 


SLLAN 

Shift left long algebraic, 
from N 

3 + n 

\ « 


SR LA 

Shift right Jong algebraic 

3 + n 


SR LAX 

Shift right long algebraic, 
from X 

3 +n 

r 

• SR LAM 

Shift right long algebraic, 
from memory 

3 + n 


SR LAN 

Shift right long algebraic, 
from N 

3 +n 


SLLL 

Shift left long logical 

, 3 + n 


SLLLX 

Shift left long logical, 
from X 

3 + n 






cs-iii 


c 


r 


> 1 


Instruction 



Table in-7." Shift Class Instructions (Continued) 


i ,i ,1 , 1 1 1 f a H ( • 1 

' Description Time (Msec) 


SLLLM , 

Shift left long logical, " 1 

from memory 

. ■ | XI Ill'll 

3 + n 

• • n 

i » ' * . » 

SLLLN 

|i,|i » | 1 . » » * ’ 1 11 M • 

t Shift left long logical, 

3 + n 


from N 

i , i i. t, )i 

> * n 

i' ■ 

SRLL 

* • 4 1 • f * • • * 

Shift right long logical 

3 + n 

SRLLX 

Shift right long logical, 
from X 

3 + n 

SRLLM 

Shift right long logical, 
from memory 

3 + n 

SRLLN 

Shift right long logical, 
from N 

i • • 

3 + n 

SRSL 

Shift right short logical 

3 + n 

SRSLX 

Shift right short logical, 
from X 

3 + n 

I 

RLS 

» • * 1 

Rotate left short 

| 

3 + n 

RLSX 

Rotate left short, from X * 

3 + n 

RLSM 

Rotate left short, from 
memory 

3 + n 

RLSM 

Rotate left short, from N " 

. 3 + n 


Comments 


1 1 , I i 1 1 i ! 1 1 1 1 ’ 1 1 ‘ 

( »i ' ;• 

1 1 v ,* ‘ ' * 1 


i i 


l i 

‘ t I ’ 


( 


t, , i 

• I* i 


$ 
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Table HI-7. 'Shift Class Instructions (Continued) 


i Instruction ' " ' Descrtption 1 Time’ ( sec) Comments 


RRS 

Rotate right short ,, 

3 + n 

RRSX 

< 

Rotate right short, from X 

3 + n 

RESM 

Rotate right short, from 
memory 

3 + n 

RRSN 

Rotate right short, from N 

3 + n 

RLL 

Rotate left long 

3 + n 

RLLX 

Rotate left long, from X 

3 + n 

RLLM 

Rotate left long, from 
memory 

3 + n 

RLLN 

Rotate left long, from N 

• 3 + n 

RRL 

Rotate right long 

3 + n 

RRLX 

Rotate right long, from X 

3 + n 

RRLM 

Rotate right long, from 
memory 

• 3 + n 

RRLN 

i 

Rotate right long, from N 

3 + n 

NS 

i i 

Normalize short 

3 + n 

NL 

Normalize long 

3 f n 




»»— 
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Table IE-8. Register Change Class Instructions 


Op 


Name 

Code 

Address 

Function 

Status 

Comments 

Add 

ADR 

ADR 

U,V,W 

u,v 

(U) + (V>-»AV 
(U) + (V)— U 

Sum 

Sum 

U=V=N illegal 
U=V=N illegal 

Subtract 

SBR 

SBR 

U,V,W 

u,v 

(U) - (V)— ►W 
(U ) - (V)— u 

Sum 

Sum 

U ^ N 
U ^ N 

Complement 

CPL 

CPL 

u,v 

U 

-(U) - 1— ►V 
-(U) - 1— U 

Unc 

Unc 


Negate 

NEG 

NEG 

U,v 

u 

-(U)— V 
-(U)-KJ 

• 


Transfer 

TR 

U,v 

(U )— v 

Unc 


Transfer and 
Test 

TRT 

u,v 

(U)— V 

Set 


Test 

TST 

u 

(U)— U 

Set 

(U) determines 
condition 

Load Status 

LST 

u 

(U)— ►Status 

- 

U fa 

.Fetch Status 

FST 

u 

(Status)— ►U 

Unc 

U * N 

-Increment 

INC 

INC 

U,v 

u 

(U) + 1— 
(U) + 1-HJ 

Sum 

Sum 

- 

Decrement “ 

DEC 

DEC 

u,v 

u 

(U) - 1->V 
(U) - 1 — ►U 

Sum 

Sum 

T 

Ulear 

CLR 

u 

O^U 

Unc 

- 

Set to minus one 

SMO 

T J 

-F-KJ 

Unc 

- 

Set to plus one 

SPO 

u 

+1-^U 

Set 

Condition set to 
positive, nonzer 

Exchange A&O 

XAQ 


(A)-*>Q; (Q)-A 

Unc 

- 

Exchange and 
Test 

XAQT 


(A)-Q; (Q)-^A 

Set 

Old (Q) deter- 
mines condition 

Notes: 1. All re 

~ 2. -Unc = 

change instructions require 2 /xsec 
unchanged 

. - 


Table IQ-8. Register Change Class Instructions (Continued) 


Op 


Name 

Code 

Address 

Function 

Status 

Comments 

Enable 

Interrupt 

El 



Unc 


Disable 

Interrupt 

DI 



Unc 


Halt 

HALT 



Unc 


Compare 

Registers 

CMR 

u,v 

<U)-(V) T 4 - 

Sum 

u/n 

Clear 

Overflow 

CO 


0-*-F0V 

- 

Condition 

unchanged 

Set Overflow 

. £ 

SO 


1-^FOV 

- 

Condition 

unchanged 

Clear Sign of A 

CSA 


0-*-A15 

Unc 


Set Sign of A 

SS A 


l-»-A15 

Unc 


Clear Sign of Q 

CSQ 

- 

0-*~Q15 

Unc 

- 

Conditional 

Increment 

CIO 

U,v 

(U) + (FOV)-»-V 

Sum 

U^N 

T* 

On Overflow 

CIO 

u 

(U) + (FOV)-*-U 

Sum 

U/N 

Conditional 
~ ' Decrement 

CDO 

U,v 

(U) - (FOV)-*~V 

Sum 

U^N 

On Overflow 

• i . 

CDO 

u 

(U) - (FOV)-*-U 

Sum 

U/N 

Notes: 1. All register change instructions require 2 /xsec 
2. Unc = unchanged 



Table IE-9. The Input- Output Class Instructions 


Instruction Description Time (/msec) Comments 


ID 


Input 

Data 


4 


Device Data-+-A. The device is 
specified in the address field of 
the instruction. 
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Table III— 9. The Input-Output Class Instructions (Continued) 


Instruction 

Description 

Time (/usee) 

Comments 

OD 

Output 

Data 

4 

(A)-*-Device. The device address 
is specified in the address field 




of the instruction. 

OC 

• Output 
Control 

4 

The control field, specified in 
the instruction word itself, is 
transmitted to the device whose 
address is specified in the 
address field. 

IM 

Input 

Mask 

4 

The mask field of the interrupt 
system is transmitted to the 
accumulator. 

OM 

Output 

Mask 

4 

The 8 bit mask field specified in 
the instruction word is trans- 
mitted to the interrupt system, 
and replaces the old mask field. 


1. Direct Memory Access Mechanization 

The DMA capability implemented in the CPU is designed to accommodate 
either a single cycle or a block transfer function as a system design option. A 
single cycle transfer is defined as the case where the processor is stopped for 
one memory cycle to allow access to a location in memory, specified by an out- 
side device. The logic then continues processing the program. A block transfer, 
on the other hand, stops the processor for as many cycles as are needed to 
complete the transfer before resumption of the program occurs. Again, an 
outside device must specify the memory locations. The single/block transfer 
option is provided in the CPU through the simple expedient of committing 
minimal processor hardware to DMA address generation. This is accomplished 
by multiplexing the processor's test console capability to allow either a DMA 
or a test console access along the same data paths. A direct memory access 
can occur any time after the completion of a memory cycle, providing the DMA 
system is enabled. Thus, the delay between a DMA request and its execution 
will be a maximum of 2 jxsec. 

2. Processor /DMC Hardware Interface 

The CPU capability uses the existing I/O bus lines for data transfer. 
However, the following additional control signals are necessary for its 
mechanization. 

• DMA Request* (DMA REQ*) - A signal from the DMA con- 
troller to the processor that indicates that a memory transfer 
is desired. 

• Direction (DIR) - A signal from the DMA controller that 
indicates the type of transfer desired. A high logic level 

III— 57 


specified a memory read operation; a low logic level, a 
write operation. 

• DMA Address Strobe* (DMA ADR*) - A negative going strobe 
pulse which is used by the DMA controller to gate AW address 
onto the I/O bus, and as a confirmation to the controller that 
the DMA request is being serviced and the DMA REQ* line 
should be raised. 

'• DMA Data Strobe* (DMA DAT*) - A negative- going strobe 

pulse which is used by the DMA controller to gate data either 
from or to the memory onto the I/O bus. 

3. Pertinent Processor Instruction 

ENABLE DMA EDMA 170300 

DISABLE DMA DDMA 170400 

4. Processor Response to DMA Request 

The DMA request line is examined by the processor during or after the 
last timing phase of a memory cycle provided that the DMA enable flip-flop has 
been enabled. When the processor determines that the DMA request line is 
-active,, it halts the program and issues a DMA address strobe which should be 
used to enable the address of the desired location in memory on to the I/O bus 

* and to raise the DMA Request line. Address information must be stable by the 
trailing edge of the strobe signal when it will be clocked into the memory 

- address register. When the DMA address strobe is raised, the DMA data 
r strobe is lowered. Data going to the memory must be stable during this tine; 
w data coming from the memory can be considered stable by the strobe's trailing 
edge. The DMA enable flip-flop remains enabled after this operation; thus, if 
^'another DMA request is received during this timing phase, the program remains 
' halted and another DMA operation occurs. If no further requests are made, a 
restart command is issued and normal program operation resumes. It should 
-he noted that, since no interrupts can be received during DMA operation, an 
illegal address interrupt will be left unserviced. Therefore, a means must be 

* designed for stopping any further direct memory access. The Inval signal 
from memory can be monitored to detect such a condition. 

-‘5. - Direct Memory Access Timing 

Figures III-24 and III-25 show the required interface signal levels and 
timing for DMA read and write operations. The interval, t, is determined by 
the amount of time necessary to complete the present memory cycle and also 
by whether the direct memory access system is enabled. 

V. IMPLEMENTATION OF CONTROL LOGIC 

The functional requirements of the control system are defined in 
S ection II. These requirements must be implemented in the control computer 
in an efficient manner to minimize the problem solution time. Computer 
architecture and program algorithms have been developed to solve the control 
problem in a minimum time interval and with minimum memory capacity. 
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Effective utilization of the hardware capability prevents resorting to marginally 
high computer speeds or compromising the functional requirements or control 
mode. 
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Figure III— 25 . Interface Signal Levels and Timing FD 52641 
for DMA Write 


The computer program contains the logic to direct the ground tests, pre- 
start, start, control during flight, and shutdown, as well as the self-testing 
which occurs throughout all phases. 

J}-* • k t • — - 

Four algorithms are employed in the control program, each performed 
by a subroutine. 


Ill— 59 






tic based <^n a^amp^ed^^t^versi^n of L* IT TT™'* 1 ™ co ^ 

£ JprC wC £' £££ S£ B£»SlS^ 

lookup^ p a e b rformed U by°the sXouTint 

sMsa iWsfiSsSSH* 5 ' 51 

computed may be used again. y faCt that ° ne t l uantit y already 

The square -root algorithm is performed bv subroutine sort tv, q o 
root of a double precision number ic n nmn „tL »v ^uoroutine St^RT. The square 
As with the lead/latr routine the puted to be a single precision number. 

1. Lead/ Lag Subroutine 

in the corUro^pfops^^he Laplace £t!Xm^f° a^ld/la/trSr Cu“?s : 


OUT = IN 


(ris + i) 

T 2 S + 1 


terms™ e e as P toUows S WMCh approxin,ate this tra " sf « '"notion in sampled data 


T1 


0UT "ri < m - Vl> +Z 


n-i 


Z n = A*- (' N - Z„_i) 


+ Z 


n-1 


tterat e ion n U 1 me. ‘ h<! Vi “ Ue ° f Z SaV6d fr ° m the previ0u5 Iteration, and at is the 

for simplicity, the ratios rl/r2 and At/T 2 are called f>l and ^>2 The 
Plan'd P?™ lS Cai 7 ie ? ° Ut in modified double precision. That is’ the inputs 

rinSeH t T Y* Smgle precision ’ but Z is in double precision. The output i^ 

rounded to single precision magnitude. P 
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The lead/lag subroutine runs for 235 /usee and uses 44 storage locations. 
Four read-write memory words must be reversed for each quantity that uses 
the lead/lag routine referred to as LEDAG. The instruction callii g sequence is: 


JSX 

FIX 

FIX 

FIX 

FIX 

FIX 

Frx 

FIX 

FIX 


LEDAG 
L (input) 

L (integral part of Z) 

L (fractional part of Z) 

L (integral part of Z shifted 5 left) 

L (fractional part of Z shifted 5 left) 
L (output) 

p 2 


2. Worst Case Three-Dimensional Lookup Routines 

A method of shortening the execution time of the worst case 3-D lookup 
has been devised. Examination of the program shows that the lookups take much 
less time tnan the computations. The lookup involves 3 linear interpolations. 


To save computation time, slopes and differences are stored with the 
coordinates. The programming takes the following form : 


XI _ Ref. Point 1 Ref. 
AXl z x 

X2 z x 

01 ' z c+2 

• . •* * 

XP+1 

--r_AXp+l : ~ 

Xp+2 


Point 2 y • • • 

*c+2, 1 

m ll 

_ m c+2, 1 

-*12 

*c+2,2 

• 

. • 

y c+2, 2 

• 

• 

y i» P + 2 

y c+2,p+2 


If the number of segments, p, equals 15, and the number of curves, c, 
equals 3, then 

2 _ (p+2 ) (c+2) + p+2 + c+2 + 2 
— 170 + 24 = 194 /X3ec 

For fifteen 3-D schedules, the total program time would be 
194 x 15 = 2910 /isec 

One advantage that the line segment method has relative to the polynomial 
method is that once the interval is found, it does not have to be sought for the 
second curve. On the other hand, the polynomial method requires that the 
whole polynomial be evaluated for both curves. 
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J ) 3. Three-Dimensional Lookup 

riroi ^o an i U , ieS , whi , ch ^ re Actions of two variables are computed by subroutine 
LK.3L1 (3-D. lookup by line segments). 

a. Method 

"The function of two variables, x and z, will be treated as a family of 
functions of x alone, and z as a parameter. 

ff z is held at the value z , the function reduces to a function of x which 
we shall curve 1. Similarly, z can be assigned appropriate values and several 
curves can be generated to cover the region ..f interest. Then, each curve will be 
approximated by a series of straight line segments. For efficiency we shall use 
the same x-intervals for all functions. 

We construct a table consisting of the value of zs for each curve, the 

^L eS , 0f the en( H?oints °f the lines which approximate the curve, and the slope 
of the line in each interval. F 




To evaluate the function for a given pair of variables, x and z, the sub- 
. ™ u ^ ne selects the two curves corresponding to the z. and z +1 closest to the 
given z. Then we find the x-interval, x tox, whrth incudes the g-ven x, 
and compute the corresponding value of the function for each curve j-J and j. 

- Then we find the x-interval such that x. < x < x. +1. For curve j let us 
call the value of the function at the given x, y., and the end-points of the interval 

(x i-i* y j* i_1 ) ^ (x i* yj* i >* ] 

Y j ~ given." 3 S-1>- m j’ i-l + y j, i-i 

In the same way, y is computed and y, the desired value of the function 
Of two variables, is obtained by linear interpolation: 


y j~l _ Z given z j -1 


y j ‘ y j-i 


z i ' b-i 


b. Timing and Storage 


Maximum execution time for a family with 16 points and 3 curves is 
360 Msec. Average time in the operating range of 100 to 109% thrust is 
_ -250 Msec. LK3L1 occupies 47 words of storage. 


— C. Calling Sequence 


LDA 

L(z) 

STA 

ZEE 

LDA 

L (x) 

JSK 

LK3L1 

FIX 

Ref pt of table 
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d. Return 

Subroutine returns to location after FIX with value of y in A -register. 

e. Data Format 

Several data formats and methods were tried, including polynomial 
approximation. The data format and method described herein, were chosen 
because they led to the shortest execution time. 

If there are p points and c curves, p + 1 sets of x, c + 2 sets of z and 
(■ + 1) x (c + 2) sets of y, slope must be stored: 

y p + 1, c + 2 

m , c + 2 
P 

m., C + 2 

y v c + 2 


z +2 
c 

y + 1, c + 1 
P 

« . 

y { + i. j • 

m., j 

j|t i 

nij, 1 

y l‘ 1 

A = The number of words stored per curve. 


W. DUAL CONFIGURATION HAS NO STANDBY ELEMENTS 


The ECU utilizes dual elements to remain operational after a single 
failure. Self test or failure detection of primary and secondary elements 
represents a mandatory diagnostic requirement. The most effective way to 
establish the integrity of dual or standby system elements is to use them. 

This approach has been taken throughout the control system design with 
active control simultaneously provided by both control units. This approach 
prevents operating redundant units simply to judge the acceptability of their 
performance, and makes the test routines of both units almost identical. Self 
tests for failure detection are performed continually and integrally with the 
control task, both on the ground and in flight, so that the failure is detected 
and reported when it occurs. 

All failure detection tests are included in operational tests. However, 
many operational readiness tests are not required in flight. Therefore the 
operational readiness routine is separate and distinct from the operating 
program. Passive readiness tests will be performed as a fallback routine 
any time the engine control unit is powered and not requested to perform 
active control. Upon command for an active ground check, the control unit 
will proceed through a simulated start, run, and shutdown utilizing the open 
loop mode. The open loop mode prevents simulating engine re.‘,ponse which 
would be required for closed loop operation. 

The ECU contains no mass storage or permanent recording capability. 

Tape recorders are not amenable to the engine environment. Providing the 
required read/ write memory in the ECU to record 10,000 bits per second for 
500 seconds is not cost effective. Consequently, the most effective way to 
obtain historical engine information is to transmit basic engine measurements, 
events, and composite parameters from the engine control unit to the 
vehicle via the data bus for recording and subsequent analysis. 

1. Control is Fail Operational, Failsafe 

. Trade studies presented in PWA FR-4439 present preliminary findings 
of a reliability study which compared several possible engine control rystem 
configurations and their relative weights, costs, and failure probabilities. 

The original study effort concluded that a .self -qualifying control system 
with implicit shutdown capability would require three redundant systems to 
conform with the fail-operational/failsafe design criteria for electronic 
systems. It was concluded, however, that this concept would yield a higher 
deg of theoretical reliability than other engine components. 

It was recommended that the redundancy be reduced to a dual system 
to produce significant savings in weight and cost without jeopardizing the mission. 
The control system is designed to have the capability of enduring major 
failures during flight with only minor momentary parameter disturbances, 
and to yield valid fault information during all phases of the prelaunch test 
period. 


Ill— 64 


Pratt & Whitney Aircraft 

PWA FR-4249 
Volume II 


Figure HI-26 shows the selected dual system. The system is arranged 
to use two paralled active computers. Each computer processes all duplicate 
measured parameter information, examining each sensor in turn for possible 
malfunction and making the best signal choice from the qualified sources. 

Should the computers fail to qualify any sensor in a given group, the system 
will revert to the simple open loop control mode which is described in the 
section on "Control Analysis and IiOgic. " Inasmuch as both computers are 
constrained by the selection logic to process identical inputs, their actuator 
command levels will also be so nearly alike that it is reasonable to keep both 
systems continuously operational. This capability produces a desirable 
failure mode response to an inadvertent servo loop hard-over disturbance. 

The unwanted valve excursion is automatically restrained by the good loop 
until the fault detecting system can disconnect the malfunctioned loop. Power 
imbalance between pairs of torque motor driver windings is minimized by 
incorporating current -comparison sensors which bias the thrust and mixture 
ratio trimming integrators of the secondary system to automatically synchro- 
nize the second control to the first. If at any time the primary system suffers 
a failure and is disconnected, the current imbalance feedback path is broken 
by software logic as soon as the secondary control is assigned a "primary" 
status. 

2. Dual Memory and Arithmetic Check Qualify CPU 

r- - - - 

Experience with the engine digital dynamic model (described in 
Avionics Trade Studies, PWA FH-4439) has indicated that loop instability 
occurs if data update rates slower than 50 solutions per second are approached. 
To provide a margin of stability, 15 milliseconds has been selected as the 
basic engine control problem solution time which must be shared by both the 
control and the self-test programs. Because a complete computer self -test 
is relatively time-consuming, it was originally planned to use whatever spare 
time was left over after the control program completion during any one 
interval for partial self test. This process would be repeated during succes- 
sive intervals until a complete self -test had been accomplished. However, 
the “complexity of the problem was such that ten iterations were necessary to 
accomplish a 100% test routine which was considered an excessive delay 
before a fault could be detected ar.l appropriate action taken. The study showed 
that the permanent memory qualification (sum check) was consuming the bulk 
of the self -test time and that a significant reduction in self -test time could be 
realized by providing two identical memories in each computer which could 
be qualified in real time by the achievement of identical readouts for every 
memory interrogation. With dual memories, a complete computer self test, 
which consists of the check on all instruction commands used by the computer, 
can be completed in one cycle. 

Three types of memory configurations are used in the computer: Metal- 
Oxide Semiconductor Read Only (ROM), programable ROM, and read/write 
scratch pad. To avoid excessive program time required to test each memory 
location during the computer cycle, the entire memory is duplicated so that 
a comparison test can be made. Figure III— 27 shows the memory comparison 
routine used. Each memory is separately addressed with the same address 
code and each time a memory read-out occurs, cor responding pairs of memory 
words are compared in a high speed buffer between the memory and the 
control register multiplexer. If no error is detected in any corresponding 
pair of bits, the error counter remains in its normal zero reset state. One or 
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more memory errors detected during one computer iteration counts as one 
error. If three errors occur over an interval of three consecutive computer 
iterations, the self-test logic will interrogate the failure status and send 
a disconnect signal to the external checker subsystem. The checker then 
removes power from the outputs of the affected computer. The three iteration 
delay (45 ms) allows short term disturbances to subside without appreciable 
effect on the control process. 

The error counter is incremented when the first error is detected in a 
given iteration cycle. The program continues and, if the error does not 
recur, the iteration count returns to 1 and the counter is reset. On the 
first error pass through the logic flow, the error counter will equal ;he 
iteration counter since the latter was initialized to 1 at power on. 

A functional self -test performed on a digital computer, can be designed 
to provide a very high level of failure detection capability. The self -test 
devised for the Space Shuttle engine computer includes all instructions used by 
the program and by the self-test routine itself. Every random failure thus 
far introduced into the program has been detected, but to achieve 100% con- 
fidence in the detection capability, an additional independent external checker 
will be used. This checker will force the computer to solve a known problem 
within a predetermined time interval and will compare the result against a 
fixed reference. 

A flow diagram of the computer self -test is shown in figure HI-28. The 
test begins by checking the commands necessary for any operation-loading 
the accumulator, comparing, and storing the results. These instructions 
are easy to test, and if proved capable, provide a powerful tool for detecting 
Ui6re complex malfunctions. Errors are counted, and if one or more errors 
persist over the three complete computer iterations, the checker will receive 
a^failure indication - no data or incorrect test word. 

The command check tests to see if a command is functioning. As an 
arbitrary classification, commands may be classified as arithmetic and 
functional. The arithmetic commands are: ADD, SUBSTRACT, MULTIPLY, 
and DIVIDE and the AND command. The function?! commands consist of the 
basic commands and others listed in table ni-10. The test philosophy is to 
exercise a command and determine if it performed correctly; if not, an error 
signal is sent out as part of a test word which can be monitored by each computing 
channel checker as a final verification of computer health. 

• S3.' - - • 

The check program is a program, and as such, uses commands which 
are basic and used repeatedly in the test routine. They are tested first, and 
when verified to be working, are used to check other commands. The basic 
commands are: Load Accumulator from Memory (LDA), Store Accumulator 
in Memory (STA), Compare Accumulator with another Quantity (CMP), skip if 
two values are not equal (SKNE), and jump to a specified location in memory 
<JU). The LDA and STA instructions are tested together, along with CMP. The 
t?MP and SKNE are tested for both comparative conditions, equal and unequal. 
When the program goes beyond the first check point, ER1, the basic commands 
are verified to be working and a bit is placed in the test word. 
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Figure III— 28 . Computer Self Test Flow Diagram FD 52611 

The arithmetic commands perform the operation on selected values, then 
the results are compared with correct values. With the AND operation there 
are four combinations: 0,0; 0, 1; 1, 0; 1, 1. The test logically ANDs these 
combinations and compares the answer to a true answer. The right half of 
the test word ANDs 0,0; 1, 1. The left half ANDs 0, 1; 1,0. With ADD and 
SUB, the same four combinations are used. All bits of the word are tested 
and compared to true values. In addition to the above conditions, tests are 
made for overflow and negative values. 

With multiplication, the adders and half -adders are exercised. That 
is, 0,0; 0,1; 1,1, carry and shift. Experimentation shows that multiplying 
111 by 1011 is the minimum test that accomplishes this exercise. Words are 
made up with this combination and tested. The multiplication should not 
overflow. A further test is made by multiplying all ones by ail ones and 
testing for overflow. 
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Table HI-10. Test Commands 


Basic. Commands 

LDA, STA, CMP, SKNE, JU 

Others 

XAQ, STQ, LDX, STX, JSX, 
AND, CLR-A, CLR-Q, INC, 

• 

-A, INC-Q, NEG-A, CIA-Q.Q, 
CIA-Q.X, CAP-A, TR-A.Q, 
TR-A.X, TR-Q.X, SLSA, SRSA, 
SLLA, SRLA, SKN<t>, SLSL, 
SKLT, SKLE, SKGT, SK<*>, 

SKGE, SKALT, SKAGE, NEG-Q 
DEC-A, DEC-X, CSQ, SBR-X, Q, 
ADR-X, A, ADR-Q.A, TST-X 

Arithmetic 

Add, Subtract, Multiply, 

Commands 

Divide 


Since division is the inverse of multiplication, similar conditions are 
tested including positive and negative values and overflow. The quotient 
and remainders are tested against their true values. 


In summary, at the start of the command test,_the basic commands are 
exercised since they are used in the majority of computing operations. 
Successful completion of these tests causes a bit to be placed in a test word 
that is initially roset by the computer cycle clock, and which is later trans- 
ferred to an external device for verification. After testing the basic commands, 
the program continues to check the remaining instructions until all bits of the 
test word are assembled. The test word is then transferred to the external 
checker for comparison with a hard wired reference code. Failure of any 
subtest will cause an erroneous bit to appear in the test word. Also, since 
the external device requires the com mter to produce the test word in a given 
time period, an inactive computer, false cycling, or faulty output processing 
can be detected. The total instruction test time Is 1 ms. 

3. Data Bus is Self Qualifying 

T 

The data bus provides bidirectional communications between the vehicle 
and the ECU. The vehicle transmits engine operation and data request 
commands and receives sensor data, diagnostic information, and redundancy 
status all on the same line. Dual buses will be employed with the assump- 
tion that both busses are simultaneously active. Both buses are connected to 
both computers with data being accepted from the primary bus until a fault 
on that line is detected. The ECU will check both buses continuously by means 
of parity check, message length detection, and data word number test. The 
vehicle is also actively involved in the determination of data bus integrity by 
receiving a known data pattern sent by the vehicle and echoed by the ECU. The 
test is made at a rate sufficient to allow a safe switchover interval in case 
of failure. 


T 
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The Manchester form of data signal will provide balanced voltages along 

, which scans for dropped bits and asynchronous message intervals. 
Failures detected in the ECU data bus interface win cause the interval timing 
cycle to be disabled to prevent transmission of erroneous date and win p 
further processing to the CPU until the fault has beer cleared. 

Each received word is checked for odd parity by ANDing the word serially 
. •* nulses The ANDed output is used to continuously clock a 

Ss =££&• its ssasfKssa. 

decision time to notify the vehicle of any data loss in transmission. 

The data finally transferred to the CPU is range checked to detect faults 
in the multiplexer, the I/O bus, or in the magnitude sent by the vehicle. 

4. Independent Checker Disqualifies Faulty ECU 

The checker subsystem, designed for each computer, provides a final 
RtafTP of validation which acts to permit the computer to continue performing 
S functionsT/completely disconnects all outputs from the computer including 
toraue motors Stone ids, and data bus transmission The checker subsystem 
is essential because one drawback of any computer self-check system is the 

fflsrriss — 

of the arrangement. 

_____ - ■■ ~ 

The disconnection of control to the output depends on the performance 
of each computer as verified by the logic circuit shown in figure HI-30. A 
minimum of hardware is used to provide the simplest and most reliab.t, 
disconnect performance. The test inputs from the computer are used to toggle 
flip-flops which form a square wave having a frequency equal to the system 
iteration rate. A failure in the computer, determined by self -tests, will cause 
either or both output lines to assume a static position, high or low, causing 
the^caiMicitors to charge to a level that switches the outputs to the of position. 
Failures in the select line, which carries a pulse to transler the test ve 
into the flip-flops, or in the input lines themselves, will mitwte the same 
disconnect P time constant. The output stage is preset by an RC circuit when 
power is turned on and allows computer initializing steps to take place before 

the check begins. 

5. All Sensors are Checked for Signal Integrity 

It was a design objective to provide a fail operational/ failsafe capability 
with duaiTelententsf Critical sense point, justify the use of 
minimize the possibility of not rejecting a sensor with a soR fa.lure T 
problem and other trade areas, ire discussed below as part of a detail 
analysis of the fault identification and signal selection rational which will be 
applied to each of the control system's parameter sensing groups. 
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Figure III— 30 . Computer Checker Schematic FD 52642 


a. Preburner Temperature Thermocouples 

The system receives signa's fr^m eight dual junction preburner temper- 
ture thermocouples, four of which are associated with the fuel pump turbine 
discharge and four with the lox pump turbine discharge (figure HI-31). Experi- 
ence with these devices has shown that although soft failures are possible in 
both plus and minus directions, the predominant mode is to fail low. Based on 
this predictable failure mode, a search pattern is used which selects a high 
median signal from the lox side group and a high median signal from the fuel 
side group. The higher value of the.se two selections is then chosen for use 
in the turbine temperature protective loop. 

b. Chamber and Wafer Pressure f'ensors 

Although, as a group, pressure sensors are considered to be subject 
to "soft" failures, only chamber and v afer pressures would appear to require 
special handling because of the possibility that undetected failures might allow 
deficieni transpiration cooling with consequent shortened engines useful life. 

To provide a method of increasing confidence in fault detection for these two 
special parameters, the control system uses three sensors each for measuring 
chamber and coolant pressure (figure III-32). A search routine has been 
programed to assess relative signal strength in each triple group and establish 
median and maximum readings. Sensors are then tested for failure by com- 
parison with the selected median. If a failed sensor is identified, it is rejected 
permanently from the selection precess. At the same time, the median selec- 
tion logic, which is no longer valid after one of the three measurements has 
failed, is modified to the more compatible "select high". Follow-on testing 
in anticipation of a second failure is based on a comparison of the two remain- 
ing signals for reasonable conformity to each other. If large discrepancies 
are encountered, the system reverts automatically to open loop control. 

The less important pressure parameters such as propellant inlet and 
flowmeter use a simple range check and a "select high" logic. 
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Figure III-32. Chamber and Wafer Pressure Sensor Logic Network 









c. Actuator Follow-up Potentiometers 

Because potentiometers as a class respond well to qualification by direct 
testing, a dual system has been considered adequate. The checking routine es- 
tablishes element integrity by means of a wiper voltage range check (figure HI-33). 
The actual range of these devices has been deliberately limited to between 10 
and 90% to ease the identification of such common faults as "shorts” or "open. " 
Should a fault be identified, the output of that pot will permanently reset to 
zero. If two faults are identified, control of the associated actuator is assumed 
to have been lost and emergency shutdown procedures are initiated which take 
advantage of the basic pneumatic design which constrains any actuator to slew 
into cutoff as soon as its control power is removed. For normal operation the 
t,/stem will select the "high" between the two available follow-up signals to 
close the actuate!* loop, rather than "low" which is the normal failure mode. 

d. Pump Speed Sensors 

Pump Speed measurements are required to protect engine from overspeed. 
Dual sensors are used for each of four pump speed measurements. Each sensor 
will be qualified in two ways during flight. It will be required to indicate a 
valve between wide speed limits to eliminate gross failures. Each reading will 
also be required to be sufficiently close to previous reading to detect discon- 
tinuities larger than pump capability to accelerate. To ensure that one unde- 
tected soft failure will not shut the engine down, the lower of two "qualified" 
sensor values will be used (select low) since the protection is against overspeed. 

The selected approach assures fail-operational/failsafe with only two 
sensors. 

The three conditions which could result in a failsafe engine shutdo’vn all 
involve a failure of both sensors, and at least one must be an undetected failure. 
This logic applies to all limit measurements except NPSP pressure, which 
would be select high because the failure condition is fail low. 

Eddy current devices are used to detect pump blade passing, the 
intervals being timed by means of a master clock (figure HI-33). The system 
stores the necessary consecutive blade intervals to form one complete revolu- 
tion (three are illustrated). Each group of clock pulses is compared with the 
previous group permissible deviation, based on the acceleration limitation of 
the rotor, to establish that the pulse train is a reasonable value. Then the 
total pulses contained in a complete revolution are examined against a range 
window to check that a reasonable signal is being received. H a failure is 
detected, that probe's output is permanently rejected. If two failures occur, 
the associated loop is automatically reverted to a mode of scheduled control. 
However, for normal operation, selection is based on the lower sensed speed 
level. Ground testing is based on the availability of a reasonable probe 
circuit output voltage. 









Table m-11 shows resulting status from all combinations of valid 
measurements, and detected and undetected failures. 


Table HI-11. Sensor Detection Results on Engine Condition 


Sensor A 


Sensor B 


Action 


Engine Condition 


Valid 

Valid 

Detected 

Valid 

Failure 


<DF) 


Undetected 

Valid 

Failure 


High (UDFH) 


Undetected 

Valid 

Failure 


Low (UDFL) 


Valid 

DF 

DF 

DF 

UDFH 

DF 

UDFL 

DF 

Valid 

UDFH 

DF 

UDFH 

UDFH 

UDFH 

UDFL 

UDFH 

Valid 

UDFL 

DF 

UDFL 

UDFH 

UDFL 

UDFL 

UDFL 


Select Low Overspeed Protection (OSP) 

Use B OSP 


Use B OSP 


Use A 


Use A 

Reject Both 
Use A 

Use A 
• Use A 
Use B 

Unknown Sel 

Use A 
Use E 
Use B 
Use B 

Unknown Sel 


Lost Overspeed Protection 
(LOSP) 


OSP 

LOSP 


Could result in failsafe 
engine shutdown 
LOSP 
OSP 

Could result in engine 
shutdown 

Could result in engine 
shutdown 


LOSP 

LOSP 

LOSP 

LOSP 

LOSP 


e. Resistive- Type Cryogenic Temperature Sensors 

Inasmuch as resistive-type temperature sensors are operating in a 
narrow temperature band, a dual system has been organized (figure m-33). 
A range window check not only confirms the availability of reasonable data * 
but also verifies the electrical integrity of the loop. Should a fault be 
identified, the output of that probe is permanently rejected. If two faults 
are identified, NPSP computations for the associated parameters are 
considered to be invalid and those protective loops are disabled. However, 
for normal operation, selection is based on the lower sensed temperature 
level which has been implemented to prevent an undetected failure during the 
engine to shutdown. 
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f. Actuator Drive Integrity 

The integrity of the servo amplifiers, torque motor coils, and inter- 
connecting cable is established by a direct comparison between "demanded" 
and "achieved" torque motor power. Figure m-34 is a block diagram of the 
system employed wherein output current is measured, processed through the 
input multiplexer, and compared for reasonable compliance with the digital 
demand. The system is designed in such a manner that if power is removed 
from the torque motors, the actuators will run to their shutoff positions 
automatically. Zero actuator speed is achieved at the 50% current level, 
thus providing a discrete normal measurement for monitoring purposes. 

This arrangement avoids the problem of not being able to immediately 
recognize an "open" torque motor coil as would be the case with a zero 
current nulling design. 

g. Actuator Drive 

Simultaneous control of the outputs with both controllers is somewhat 
unique and provides a smooth failure transistion. Although each actuator 
drive jetpipe torque motor is provided with dual windings, so designed to be 
driven continuously by both primary and secondary computers, failure modes 
can be identified which could result in partial or total output disqualification. 

In general, the cause-and-effect chain which might create the circumstances 
governing an output "disconnect" situation is shown in table El-12. 

Detail Logic covering all segments of the system are contained in the 
Avionics Trade Studies, PWA FR-4439. 

For the purpose of illustration, the fuel valve channel and the protective 
locks have been chosen as typical and are shown in figure IE-35. 

h. Fuel Channel Failure Response 

Figure IE-36 shows the decision making paths leading through the 
primary and secondary computers which, although only a remote possibility 
could lead to the emergency removal of fuel valve actuator torque motor 
power. Heading the process is a checker (one per computer) designed to 
determine if its CPU has the capability to perform routine operations. E a 
checker finds its computer to be deficient, it has the authority to override 
that computer’s decisions and independently disconnect all associated torque 
motor windings. However, if a checker finds its computer to be fully 
operational, the search routine examines the fault status of both fuel andLOX 
flowmeter pressure and temperature sensors for possible double failure. 

If such a condition exists, it will be found by both computers and each will 
acknowledge the lost confidence in flow measurements by permanently 
suppressing its mixture ratio error integrator to zero and reverting to 
open-loop control. The routine next examines those failure modes which 
could render the channel useless such as a fuel valve servo loss, or a double 
follow-up signal loss. E any of these faults are found to exist, the associated 
torque-motor winding will be disconnected. In addition, it will examine the 
cooling, P/B, and M/B actuator drive status and take action to proliferate a 
general shutdown if any of these, because of other faults, are found to have 
received shutdown commands. This final logic is provided to insure that any 
second failure is indeed "safe", although the probability of occurrence is only 
a slight 1 part in 1 billion for any valve at random during a single 500-sec ^ 

burn as shown in the Avionics Trade Studies, PWA FR-4439. 
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Table HI-12. Generalized Failure Mode Response 


Type Failure 

Level 

ECU Response 

Computer self test 
arithmetic memory, 
instructions, power 
supply, input, output 
vehicle data line 

Single Failure 
Double Failure 

Checker disconnects channel, 
standby carries on 

Both channels disconnected 
for a safe shutdown 

w 

Closed loop sensor 

Single Failure 

Alternate sensor carries on 

self test 

median selection 
range 

mutual conformity 

Double Failure 

Associated trim reverts to 
open loop mode 

Protective sensor 

Single Failure 

Alternate sensor carries on 

self test 

median selection 
range 

mutual conformity 

Double Failure 

Associated override is dis- 
connected. System runs 
without that protective loop 

Follow up sensor 

Single Failure 

Alternate sensor carries on 

self test 
range 

mutual conformity 
element continuity 

Double Failure 

All outputs are -disconnected 
for a safe shutdown 

Servo self test 

Single Failure 

Alternate servo carries on 

‘ power gain checks 

Double failure 

All outputs are disconnected 
- for a safe shutdown 

x 


- - 
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Protective Loop Failure Response 


Figure HI- 3 7 examines in detail those circumstances which might create 
conditions of lost confidence in the engine control system's protective loops. 
The computation which provides a value for fuel LSI inlet NPSH would no 
longer be correct if double failures are encountered on any of the following: 
fuel injet pressure, fuel inlet temperature, fuel flowmeter pressure 
differential, fuel flowmeter temperature, or fuel LSI speed. In addition, 
double failures of any of the LOX inlet pressure, LOX inlet temperature, 

LOX differential pressure, LOX flowmeter temperature, or LOX LSI speed 
sensors would cause the computation of LOX LSI inlet NPSH to be incorrect. 
The computer would act to identify the possible existence of either of these 
two conditions and act to suppress the discredited loop output level to zero 
thus preventing an improper thust reduction. Similarly, double failures of 
either the fuel pump or LOX pump speed sensors would cause to disqualify 
the integrity of the main pump override loops by a suppression of possible 
false power curtailment commands. On the other hand, because of the 
additional available redundancy, the preburner temperature sensing group 
can endure three failures before becoming useless as a protective aid. 

The suppression of erroneous data will take place simultaneously in both 
channels inasmuch as each computer is receiving the same sensor information 
and must respond in an identical fashion. As previously discussed, the 
probability of total loss of any protective loop is remote, less than 1 x 10~ y 
in most cases for any 500-sec burn period. Nevertheless, all necessary 
logic is provided to ensure that any second failure is indeed "safe. " The 
Avionics Trade Studies, PWA FR-4439, present detail computations. 

j. Solenoid Drive 

Similar to the arrangement used for the main valve actuators, the 
solenoid valves are provided with dual windings, designed to be driven 
simultaneously by both primary and secondary computers. In addition, each 
of these coils has a pull-in and latching element to minimize steady-state 
power drain (figure HI-38). A current sensing circuit is used to confirm 
coil integrity during off duty periods and plunger position is confirmeo by 
means of dual proximity sensors. Both computers normally issue the same 
commands to the solenoid, which responds with double the force actually 
required to move the valve, thus assuring positive actuation. A sensor 
failure mode is recognized when one of the two computers might fail in 
such a manner that solenoid power could not be disconnected after a start 
had been completed (if either can engage then both must disengage). This 
contingency is accounted for by the checker unit described previously, which 
has the authority to override the faulty computer and switch off the 28 vdc 
supply passing through the doubtful channel. 
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SECTION IV 
SENSORS 


A. PROPELLANT FLOWMETERS 


1. Introduction 

Measurements of total fuel and oxidizer flow rates are required for con- 
trolling engine mixture ratio. The OEI Specification requires that the engine 
control be capable of establishing mixture ratio within ±2% (three sigma pre- 
c“‘on) of I value at Lady state conditions. Various ^measure- 
ment concepts were considered and are discussed in the Avionics Trade Studies, 
PWA FR-4439. 

The installation of low loss flow tubes between the low pressure and high 
pressure turbopumps is the most suitable approach for the SSME flow . m ^sure- 
ment requirements. Table IV- 1 compares the major advantages and disadvan- 
tages of the low loss flow tube with those of turbine flowmeters and force screen 

flowmeters. 

Low loss flow tubes have no moving parts, can meet, the CEI Specification 
precision requirement, and can also meet structural criteria, material com- 
patibaity requirements, and functional interchangeability requirements of the 
specification. 


2. Description 

A low loss flow tube is a form of heat meter consisting of a machined con- 
toured section providing a throat which temporarily accelerates the fluid and 
temporari’ lowers its static pressure, and a downstream diffusing section 
which proviues maximum pressure recovery and minimum overall pressure 
loss. (Refer to figure IV- 1, and the Avionics Trade Studies, PWA FR-4439. ) 
Pressure ports are located upstream of the meter throat and at the throat. Each 
set of pressure ports is connected to a piezometer ring which connects to redund- 
ant differential pressure transducers for determining the pressure differential 
between the inlet and throat. These transducers are discussed in Section IV- 1. 

Data from manufacturers of low loss flow tubes indicate that these meters 
are most efficient than other forms of heat meters, including standard venturis. 
The fuel flowmeter is designed for a differential pressure of 48 psi at El L, 
with an overall pressure loss of 5 psi. The oxidizer flowmeter is designed for 
a differential pressure of 95 psi with an overall pressure loss of 10 psi. 

Flow rates are calculated using the differential pressure, the fluid density 
determined from pressure and temperature measurements, and meter flow 
characteristics determined by calibration. 

The flow tube sections will be calibrated on water while installed in the 
engine plumbing configuration to verify that flow and pressure loss character- 
istics meet design specifications. A schematic of the water calibration facility 
is shown in figure IV-2. Data to verify flowmeter characteristics on cryogenic 
propellants will be recorded during powerhead subsystem and engine tests. 




IV- 1 


IV-2 


Table IV- 1. Flowmeter Comparison 



Flowmeter 


Low Loss Flow Tubes 


Turbine Flowmeters 


Force Screen Flowmeters 


Advantages 
No moving parts 

Can be welded into engine plumbing 

Less sensitive to installation effects 
than other head meters 

Meet interchangeability requirement 
Low pressure loss 
Good response 

Extensive cryogenic experience 

Satisfactory response 
Very repeatable 

No rotating parts 

Good response ‘ 


Disadvantages 

Directly dependent upon reliable 
differential pressure measurements. 


Require calculation of mass flow 
from pressure and temperature 
measurements 


Possible damage due to over- 
speed on gas during cooldown 


Plumbing configuration makes 
installation difficult 

Effects of propellant contami- 
nation on meter bearings 

Cryogenic performance 
unproven 

Vibration sensitive 
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3. Requirements 

Table IV-2 presents the design requirements for the propellant 
flowmeters. 

Capability 

Low loss flow tubes with cryogenic differential pressure transducers meet 
the CEI Specification requirement for determining mixture ratio within ±.2%. 

The three sigma long-term precision of the flow measurements at NPL will be 
.Within ±0. 6% of point, resulting in mixture ratio precision within ±0. 85%. At 
-minimum power level, the precision of flow and mixture ratio will be ±1.35% 

-and ±1. 9% of point, respectively. 

‘if Since a low loss flow tube has no moving parts and its performance 
depends primarily upon its dimensions, it can meet the requirement for replace- 
ment without a recalibration firing of the engine. The meters are inherently 
reliable and can be stored with no degradation of reliability or operating life. 

The simplicity of the meter design allows lightweight meters which can 
be welded directly into engine plumbing and also meet the CEI Specification 
-structural criteria and material compatibility requirements. 

Low loss flow tubes with multiple pressure taps and piezometer rings 
are less sensitive to installation effects than other forms of head meters such 
as orifices or nozzles. Being shorter in length than standard venturis, they 
can therefore be installed in the short length of straight plumbing available and 
will perform satisfactorily. 

5. Substantiation 

r - We have used over 600 head meters, including orifices, nozzles, venturis, 
and low loss flow tubes for flow measurements on such programs as RL10, 
XLR129, JT11, SST, and F100/F401. The fluids measured include water, 
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cryogenics (liquid hydrogen, liquid oxygen, liquid nitrogen, liquid fluorine, and 
liquid hydrocarbons), jet fuels, lubricating and hydraulic oils, air, steam, 
natural gas, and gaseous hydrogen, oxygen, helium, nitrogen, fluorine, and 
hydrocarbons. We have used the technology developed to meet these require- 
ments in the design of the low loss flow tubes for the SSME. 

B. CRYOGENIC TEMPERATURE SENSORS 

1. Introduction 

Measurements of fuel and oxidizer temperatures are engine control 
parameters for flight, nonflight, and engine health applications. Immersion 
platinum resistance thermometers are used as sensors for these applications 
because of their precision, stability, and durability. 

Measurement of cryogenic temperatures at the flowmeters, between the 
low and high pressure pumps, enalbes mass flow to be calculated. This mass 
flow is then used to measure and control the engine mixture ratio as described 
in the CEI Specification. Measurement of cryogenic temperatures ahead of the 
low pressure pumps will be made for NPSP limit protection. 

2. Description 

Platinum resistance thermometers have been selected for cryogenic 
temperature sensors. This selection is based on trade studies reported in the 
Avionics Trade Studies, PWA FR-4439. 

Immersion sensors (figure IV-3) for cryogenic service are shielded 
platinum resistors wound on a platinum mandrel. This sensing element assembly 
is supported by a stainless steel stem, designed to withstand all anticipated 
flow 'rates and engine vibration levels. The platinum resistor is electrically 
insulated from the stem and mandrel and covered by a thermally conductive 
ceramic coating. The materials used in the sensing element (resistor, mandrel, 
an d ceramic coating) are selected for nearly identical temperature coefficients 
of expansion, greatly reducing resistance shifts due to strain. A metal shield 
protects the ceramic coated element from erosion caused by particles in the 
flow stream. 

Design proof pressure of the sensors is 6600 psia with appropriate sealing 
to meet CEI Specification. 

The sensor wiring terminates outside the engine in a hermetically sealed 
connector, and mates with the engine harness at this point. 

These sensors have known resistance/temperature characteristics, and 
all sensors are interchangeable within specified limits. To improve reliability 
and reduce calibration uncertainty, no trimming resistors are used. 

Calibration of these sensors is performed as described in the Quality 
Assurance Verification Analysis Report, PWA FR-4066. NBS traceable 
platinum resistance thermometer standards are used to compare with the test 
item at liquid hydrogen, liquid nitrogen, liquid argon and ice point tempera- 
tures. Two Mueller bridges simultaneously measure the resistance of the test 
and standard thermometer. 


Table IV-2. Flowmeter Design Requirements 


— - -- 

Fuel Flowmeter 

Oxidizer Flowmeter 

Flow Rate 

35 to 215 pps (precise 
measurement required 
from 90 to 215 pps) 

230 to 1285 pps (precise 
measurement required 
from 575 to 1285 pps) 

Pressure 

110 to 265 psia 

80 to 460 psia 

Temperature 

39 to 46 °R 

163 to 175 °R 

Pressure Loss 

5 psi maximum at NPL 

10 psi maximum at NPL 

Response Time 

100 ms 

100 ms 

Three Sigma 
Precision 

Mixture ratio within +2% of point at steady state 
conditions trom NPL to EPL conditions 

Interchangeability 

Must be capable of replacement without a recalibration 
firing of the engine 

Installation 

In approximately three pipe diameters of straight 
plumbing 

Storage 

No degradation of reliability 
the storage period 

or operating life during 

Structural Design 
Criteria 

As specified in CEI Specification No. CP2291B, 
paragraph 3. 7. 7. 1. 




Figure IV-3. Cryogenic Immersion Sensor FD 52433 
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«h Design Requirements 

The cryogenic temperature sensors are of the immersion type and encounter 

internal fluid temperatures and pressures. Their environment has been defined 
from cycle data and summarized as follows: 

Oxidizer 172 to 590°R 
Fuel 36 to 590 °R 

Oxidizer 0 to 425 psia 
Fuel 0 to 300 psia 

Oxidizer ±0.34°R 
Fuel ±0.34°R 

Varies with flow conditions, 

0. 3 sec or less 

Meet all CEI and ICD 
requirements (refer to PWA 
FR-4377, drawing 
No. L222078) 

Meet all CEI requirements 

Meet all maintainability 
requirements (refer to the 
Maintainability Program 
Plan, PWA FR-4061. ) 

v * 

4. Capability 

Resistance thermometers of the type described will meet the require- 
ments of the CEI Specification and ICD. Sensor long-term precision can be as 
_low as ±0. 1°R within a limited temperature range. Wider tolerances allow the 
use of a single sensor design for all cryogenic applications, reducing sensor 
cost and spare parts inventory. A single curve fit fills all requirements for 
cryogenic immersion sensors. Structurally, the probes were designed to 
withstand much higher pressures than the design requirements of 6600 psia 
proof pressure, and to resist twice the rated flows. All external materials 
used in sensor fabrication are compatible with liquid oxygen and liquid hydrogen. 

Response of the sensor is within control requirements. 

5. Substantiation 

• . . * platinum resistance thermometer is the only sensor that is compatible 
with SSME total system requirements for precision, stability, response, and 
reliability. Other sensor types considered included thermocouples and ger- 
manium thermometers. Thermocouples were rejected because of inherently 
poor resolution and stability at cryogenic temperatures. Germanium thermom- 
eters have not been developed sufficiently to provide the required precision. 

Platinum resistance thermometers used to support the XLR129, 250K, ✓ 

and 350K programs are similar in design to those used as SSME sensors. 

rv-7 



• Temperature levels 

• Pressure 

• Long term precision 

• Response 

• Structural 

• Endurahce 

• Maintainability 


Resistance versus temperature for these sensors is shown in table IV-3. At 
the time specifications for these sensors were established, the vendor could 
not guarantee tighter tolerances than the interchangeabilities shown. However 
P&WA experience in the XLR129 program indicates this interchangeability can’ 
be improved! (from ±1. 5°R to ±0. 3°R in liquid hydrogen). Table IV-4 illustrates 
the magnitude of expected interchangeability improvements at all required 
temperature levels. 

• A number of immersion sensc r failures were experienced during XLR129 
staged combustion tests due to erosion of the ceramic coated platinum resistor 
by minute, high velocity particles in the flowing medium. These failures could 
be eliminated by changing element designs to a fully enclosed, stainless steel 
sheath; however, experience with the enclosed element design in our liquid 
fluorine/hydrogen engine development programs has shown these elements to be 
less stable and more prone to vibration failure than the ceramic coated element. 
We are currently evaluating redesigned sensors with ceramic coated elements 
protected from particles by two perforated stainless steel sheaths. This sensor 
s ould have the erosion resistance of the fully enclosed element, while retaining 

the stable, vibration- resistant ceramic coated element. 

Table IV-3. Purchase Specification Resistance/Temperature Function 
for XLR129 Cryogenic Temperature Sensors 


Temperature 
- (°R) 

Resistance (ohms) 
Pins A to D 

Interchangeability 

<°R) 

(LH 2 ) 36.60 

6.58 

±1.50 

44.00 

12.17 

±1.50 

- 52.00 

— 21.30 — - 

- ±1. 50 

60.00 

33.72 

±1. 50 

r y~; 70.00 

, 53. 60 

±1. 24 

80.00 

77.52 

— • ±1.03 

- 90.00 

104.60 

±0.89 

:r . : 110.00 

164.94 

. - ±0.69 

- 130.00 

229. 68 

±0.56 

_.-r. 145.00 

279. 29 

±0. 50 

155.00 

312.61 

±0.50 

.165.00 

345. 96 

±0.50 

175.00 

379. 19 

±0.50 

— 185.00 

412.28 

±0.50 

200. 00 

461.66 

±0.50 

220.00 

527.06 

±0.47 

240.00 

591. 99 

±0.44 

p.a:’: 260.00 

656. 47 

±0.41 
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Table IV-3. Purchase Specification Resistance/Temperature Function 
for XLR129 Cryogenic Temperature Sensors (Continued) 


Temperature 

(°R) 

Resistance (ohms) 
Pins A to D 

Interchangeability 

<°R) 

280.00 

720. 55 

±0.38 

300. 00 

784. 25 

±0. 35 

320.00 

847. 60 

±0. 33 

340. 00 

910.62 

±0.31 

360.00 

973. 34 

±0.30 

380. 00 

1035. 78 

±0.30 

400. 00 

1097. 96 

±0. 30 

440.00 

1221.59 

±0.30 

480.00 

1344. 34 

±0.30 

(Ice) 491. 67 

1360. 00 

±0.30 

~500r00 

1405.41 

±0.30 


TableJEV-4. Specification Interchangeability Improvement 


True 

Temperature 

(°R) 

Bias 

(°R) 

20 

Precision 

(°R) 

Specification 

Interchangeability 

(OR) 

Liquid Hydrogen Calibrations 

* 

- - - 

36.6 

±0. 156 

±0.206 

±1.50 

39.9 

±0. 107 

±0. 162 

±1. 50 

42.4 — 

±0. Ill 

±0. 148 

±1.50 

44.4 ‘ 

±0.054 

±0. 120 

±1. 50 

Liquid Argon Calibrations 




159.0 

-0.013 

±0.086 

±0.50 

167.0 

-0.022 

±0.116 

±0.50 

173.7 

-0.019 

±0.110 

±0.50 

179.2 

-0.019 • 

±0. 112 

±0.50 


Long term stability of the sensors to be used on the SSME can be demon- 
strated by evaluation of the stability of sensors used for the RL10 and XLR129 
programs. All of these sensors use the same element design (ceramic coated) 
£ut the RL10 sensors included the added complexity of trimming resistors. 


which may contribute some additional resistance instability. The long term 
drift and calibration history of these sensors are illustrated by figures IV-4 
and IV- 5. 

These data illustrate the excellent stability of these sensors. P&WA has 
“accurately measured the temperature of high pressure, high velocity liquid 
hydrogen and liquid oxygen in support of the 50K, 250K, 350K, and XLR129 
development programs. We can provide high quality cryogenic immersion 
temperature sensors for the SSME. 


RL10 Development Program 
Platinum Resistance Thermometers for Liquid 
Hydrogen Temperature Measurements 
Data Based on Calibrations at 39.9°R 
All Data Traceable to the National Bureau of 
Standards 

Rosemount Model 157AE 


Legend: 

G S/N 1225 

S S/N 1235 
S/N 1265 
O S/N 1630 
V S/N 1230 


O 0.10 


— — f— — -4- — — | - Purchase Specification Limit — “f — — r - “ ' 


E 0.05 


>-0 1o|- — « — — — Purchase Specification Limit • ^ 

° I960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 


Figure IV-4. Cryogenic Immersion Sensor 
History, Liquid Hydrogen 
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RL10 Development Program Legend: | 

Platinum Resistance Thermometers for Liquid Qs/N 1166 

Oxygen Temperature Measurements PJjS/N 1197 

Data Based on Calibration at 179°R AS/N 1346 

All Data Traceable to the National Bureau of Qs/N 1660 

Standards yS/N 1686 

Rosemount Model 157AD 

— — — — f- — “f” Purchase Specification Limit " | | 
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Figure IV-5. Cryogenic Immersion Sensor 
History, Liquid Oxygen 
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C. TURBOPUMP HOUSING TEMPERATURE SENSORS < 

1. Introduction 

Measurement of the high pressure oxidizer pump volute housing tempera- 
ture and the high pressure fuel pump volute housing temperature are engine 
control parameters in flight and nonflight applications. Platinum resistance 
thermometers bolted to the housing surface will be used. Measurement of 
these housing tempeatures will allow monitoring the chilldown condition 
of the pumps in order to avoid undesirable variations in start transients. 

2. Description 

Platinum resistance thermometers have been selected for pump tempera- 
ture sensors. This selection is based on trade studies reported in the Avionics 
Trade Studies, PWA FR-4439. 

Resistance thermometers for housing temperature measurements 
(figure IV-6) consist of platinum resistors bonded to, but electrically insulated 
from, a flat thermally conductive surface which is bolted in intimate contact 
with the housing, whose temperature is to be determined. The housing surface 
is machined to improve thermal contact with the sensor surface. Retaining 
studs and sensor housing materials selected ensure that good thermal contact 
is maintained over the expected operating temperature range. 



Sensor 
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The sensor wiring terminates on one surface of the housing with a 
hermetically sealed electrical connector, and mates with the engine harness 
at this point. Dual sensing elements are included in each sensor. These 
sensors have known resistance/temperature characteristics, and all sensors 
are interchangeable within established limits. No trimming resistors are used, 
in order to improve reliability and reduce calibration uncertainty. 


3. Design Requirements 


The sensors will be located on the external surface of the pump housing 
and will not be subjected to internal pressures. The temperature range encountered 
will vary from the internal fluid temperature, obtained from cycle data, to the 
external ambient temperature. 


The design requirements are summarized as follows: 


Temperature 


Oxidizer Pump Housing 
Fuel Pump Housing 


700*R to 170*R 
700*R to 37"R 


Pressure 


long-term Precision 


0 psia to 14.7 psia 
±3.6*R 


Structural 


Meet ail CEI and CDI requirements. 
(Refer to PWA FR-4377, Drawing 
No. L222048. ) 


Endurance — 
Maintainability 


"Meet all CEI requirements 


i nrowi 


Meet requirements of the 
maintainability program. 

(Refer to the Maintainability 
Program Plan, PWA FR-4061. ) 


4. Capability 


The required long-term precision is ±3.6*R. For a properly mounted 
platinum resistance sensor, this precision could be as low as ±1.5*R over these 
extended temperature ranges . The larger design precision requirement will 
allow the use of a single design, less expensive sensor for all housing tempera- 
ture measurements. Resistance temperature sensors of this type will meet 
the requirements of the CEI Specification and ICD. Sensor response is within 
control requirements. 


5. 


Substantiation 


The types of sensors considered included thermocouples, germanium 
sensors, and platinum resistance sensors. Thermocouples were rejected 
because of their poor resoltuion and instability at cryogenic temperatures. 
Germanium sensors do not offer adequate long-term precision. Platinum 
resistance sensors, as previously described, offer acceptable long-term 
precision and good resolution at cryogenic temperatures. 
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Pump housing temperature measurements on RL10 engines were obtained 
with platinum resistance thermometers inserted into holes machined through 
protrusions on the outside of the pump housings. While these measurements 
proved satisfactory in most cases, some nonrepeatable flight data was obtained. 

Ground tests at P&WA indicated that data nonrepeatability was probably due to 
variations in heat transfer characteristics between the pump housing and the 
sensing element. This uncertainty associated with the mounting of the sensors 
can be minimized by assuring good thermal contact between the sensor and the 
surface-. This could be accomplished by mounting the sensor with either 
(1) an adhesive, (2) a welded joint, or (3) a bolted union. The adhesive method 
introduces a thermal insulator between the sensor and the surface, and the 
sensor is not easily replaced. The welded joint mechod will provide good 
thermal contact, but its installation may cause damage to or a strain on the 
sensing element, and replacement of the sensor is difficult. Good thermal 
contact may be assured with a bolted union by machining the mating surfaces. 

The bolted sensor is also easily replaced. 

Insufficient engine operating data are available to assume that the pump 
housing sensors will always operate properly throughout the engine design life. 

For this reason, the easy l'eplacement of sensors was a design goal. The 
engine control is designed to allow safe operation of the engine in the event of 
sensor failure. 

D. TEMPERATURE MEASUREMENT BY THERMOELECTRIC TECHNIQUES 

1. Introduction . — 

The selection of thermocouples for hot gas temperature measurements 
in the SSME was based on the relative simplicity and durability of thermo- 
couples when compared to most other temperature measurement techniques. 

The location and signal utilization of thermocouples are (1) high pressure 
oxidizer turbopump turbine exit, (2) high pressure fuel turbopump turbine exit, 

(3) prebumer igniter torch cavity, and (4) main chamber igniter torch cavity. 

Measurements at (1) and (2) protect the turbine from over temperature.' 
Measurements at (3) and (4) indicate that ignition has occured. 

2. Description 

-e* -Turbine inlet and discharge temperatures will be measured using single 
point thermocouple sensors with dual junctions (figure IV-7). Radiation 
pyrometers, ultrasonic pyrometers, gas emission/absorption, and pneumatic 
probes were other techniques considered for this measurement. The thermo- 
couple selection is based on trade studies-reported in the Avionics Trade 
Studies, PWA FR-4439. 

The thermocouple exhibits simplicity, adequate precision, and low cost. 

Window requirements, sophisticated electronics, and high cost eliminated the 
other techniques considered. 

“- "The turbine temperature sensor structures will be fabricated from materials 
that have demonstrated satisfactory strength and life characteristics in the turbine 
environments . The thermocouple inserts are fabricated from drawn wire 


assemblies consisting of an outer metal sheath, high purity magnesium oxide 
insulation material, and two thermocouple pairs. The thermocouple selected 
for this application is Chromel versus Alumel. A high pressure seal is obtained 
by use of Dynatube fittings. The thermocouple inserts terminate outside the 
engine with hermetically sealed connectors and mate with the engine harness 
at this point. Pins and sockets in the electrical connectors are fabricated from 
thermocouple materials. The sensors are designed and fabricated so that radi- 
ation, recover and conduction errors are reduced to acceptable levels. 



- - Torch igniter temperatures will also be monitored with thermocouples. 
Thermocouples provide the most inexpensive and convenient temperature measure- 
ments at these locations. Drawn thermocouple assemblies are again utilized. 
---The thermocouples terminate outside the engine in hermetically sealed connectors, 
and mate with the engine harness at this point. Pins and sockets of the electrical 
connectors are fabricated from a Ihermoelectrically suitable material. The 
thermocouple pair selected for this application is platinum versus platinum 

- -^10% rhodium. 

- Thermocouples in the turbines, preburners, and mainbumers may be 
subjected to both oxidizing and reducing environments. No thermocouple pairs 
are recommended for both oxidizing and reducing environments. To prevent 
degradation of the thermocouple wire because of the hostile environment, the 
thermoelements will be sheathed with a protective jacket. Because th3 thermo- 
couples will require this protective sheath, thermocouple materials producing 
. ..a high electrical output could be selected without regard to the environment 
recommended for their use. Calibration of thermocouple elements will be 
performed as described in the Quality Assurance Verification Analysis Report, 
PWA FR-4066. The elements are calibrated by making a junction at one end 
of the leads, inserting the junction into various metal freeeaing point standards, 
and comparing the output with NBS tables of EMF versus temperature. The 
freezing point standards are periodically checked against NBS traceable resistance 
thermometers and thermocouples. Thermoelement resistance (wire to wire, 

- •. wire to ground, and wire resistance) as well as pressure capability is checked 
e-v routinely as pait of the calibration procedure. 
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3. Requirements 

Table IV-5 presents the design requirements for thermoelectric sensors. 


Table IV-5. Thermoelectric Sensor Design Requirements 


Parameter 

Requirement 

Items (1) (2) 

Items (3) (4) 

Temperature Range 

500°R to 2400“R 

2500° to 3400°R 

Pressure 

630 to 6023 psia 

1. 5 to 5640 psia 

Response 

Varies with flow conditions 

0. 5 sec or better 

Long-Term Precision 

±24.6“R 

±24. 6*R 

Structural 

Meet all CEI and ICD requirements (Refer to 
PWA FR-4377, Drawing No. L222078.) 

Endurance 

Meet all CEI requirements. 


Maintainability 

Meet requirements of the maintainability program. 
(Refer to the Maintainability Program Plan, 

PWA FR-4061. ) 


4. Capability 

Thermocouples will satisfy the requirements for temperature range, 
pressure, and precision. However, structural and life requirements may 
degrade the response capability. Shielding of the thermocouple will improve 
durability and pressure sealing, but the added mass and thermal insulation 
may increase the sensor time constant beyond desired limits. These effects 
will be studied and evaluated during a backup technology program before final 
production designs are established. The sensor designs will meet all structural 
requirements of the CEI Specification. 

5. '^ Substantiation 

‘ — Turbine temperature sensor design follows, to a largo extent, procedures 
utilized by P&WA on turbojet engines. P&WA has built over 45, 500 air breathing 
turbine engines, which have accumulated more than 227,000,000 flight hr. 

'All of these engines were supplied with thermocouple instrumentation. The 
J58 and F100/F401 were developed with thermocouple instrumentation used in 
the turbine section as a control input. The temperature environment at the 
J58 turbine control thermocouple location is the same as the SSME turbine 
discharge. 

Preburner discharge gas temperatures were measured during XLR129 
staged combustion tests. Multipoint thermocouple rakes were used. Initial 
thermocouple life was limited, due to LOX rich facility shutdown procedures, 
resulting in high gas temperature spikes. Thermocouple life was improved 
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during the XLR129 program with platinum rhodium thermocouple wire and 
platinum rhodium tubing in the rake structure. The planned backup technology 
program will continue to improve the life characteristics of the thermocouple 
sensors for the SSME. 

_E.__ VIBRATION SENSORS 

1. r * Introduction 

Engine vibration measurements require a rugged, repeatable, and highly 
reliable transducer. Piezoelectric accelerometers mounted on the turbopump 
housings will provide limit protection at destructive vibration levels. Piezo- 
electric accelerometers mounted on the prebumer and mainburner cases will 
detect unstable combustion during ground and flight tests. Piezoelectric 
accelerometers used for the same purposes during development of 350K and 
250K high pressure turbopumps and 250K high pressure staged combustors 
were proven to be rugged, reliable, and repeatable. 

2. Description 

_ - ; Reliable, repeatable piezoelectric accelerometers built to withstand the 
engine environments will measure vibration on the turbopumps and the preburner 
_,_£nd main combustor. The physical size of each accelerometer is as shown in 
figure IV-8. The accelerometer wiring terminates in a hermetically sealed, 
coaxial connector located on top of the accelerometer. The accelerometer 
attaches to the engine by an integral stud on the accelerometer base and senses 
— vibration on an axis parallel to the integral stud. The acceleromecers are inter- 
changeable from unit-to-unit and location-to-location without recalibration or com- 
pensation. Trade studies show that other types of vibration transducers will not 
withstand the extreme environment or the measurement requirements of the engine. 

-, (Refer to Avionics Trade Studies, PWA FR-4439. ) Only piezoelectric accelerometers 
-‘combine high frequency response, wide dynamic range, simplicity, durability, and 
r repeatability. Piezoelectric accelerometers have demonstrated satisfactory per- 
r fovmance during directly comparable applications. 

r „3. - Requirements 

Design requirements for vibration sensors are as follows: 

1. Operational 

• Electrical charge per unit vibration optimized for the 
temperature environment 

• Useful frequency range of 5 to 15,000 Hz with predict- 
able phase characteristic 

- - -- • Dynamic range in excess of 92 db 

• Interchangeable unit-to-unit, location-to-location 

= without recalibration, compensation, or adjustment 

; - • Durable and simple to install without engine adjustment 


-r 
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2. Environmental 

i ~j 


• 

Temperature range 

30*R to 960*R 

• 


Vibration level 

±0. 1 g to ±4000 g 


• 

Humidity 

hermetically sealed 


• 

Must satisfy the structural and environmental require- 
ments of CEI and ICD specifications. 


4. Capability 

Piezoelectric accelerometers will meet or exceed the requirements of the 
CEI specification and ICD. The specific high frequency (15K Hz) requirement 
for the combustor-mounted accelerometers will be met by using a matching 
electronic filter to compensate for the increased sensitivity at high frequencies 
rather than by miniaturizing the accelerometers to increase their mounted 
resonant frequency at the expense of durability. 
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Figure IV-8. Vibration Sensor 
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5. Substantiation 

Piezoelectric accelerometers similar to the design requirements have an 
established history of use for vibration safety limiting and for combustion 
instability detection on cryogenic rocket engines and high pressure cryogenic 
rocket engines. Piezoelectric accelerometers are used to measure turbopump 
vibration for safety limiting and for engine acceptance criteria on RL10 production 
firings. They were used also as the vibration sensors on automatic, fast response, 
limit detection systems used during development of all 250K fuel turbopumps and 
350K fuel and oxidizer turbopumps. Piezoelectric accelerometers were used to 
measure combustion frequencies beyond the range of the CEI specifications on 
250K staged combustion firings. 

F. SPEED SENSORS 

1. Introduction 

Inductive proximity, eddy current-type speed sensor systems provide fuel 
and oxidizer pump speed measurements. Installed in the pump housings, the 
sensors detect the passage of the nonmagnetic impeller or inducer blades. The 
passage of each blade is represented at the output of the speed system by a 
pulse. The speed of the fuel and oxidizer pump shafts is determined by relating 
the frequency of the pulse train directly to the rotational speed of the pump shaft. 

2. - Description 


The inductive proximity eddy current-type speed systems are best suited 
for measuring the SSME fuel and LOX pump shaft speeds. This decision was 
based on the results of trade studies. (Refer to the Avionics Trade Studies, 

PWA FR-4439.) The advantages and disadvantages of various types of speed 
sensor systems are shown in table IV— 6. Each eddy current speed system con- 
sists of a probe. RF oscillator/demodulator/comparator circuitry (figure IV-9), 
and an interconnecting coaxial cable. The electronic circuitry can be mounted 
remote from the probe. The probe consists of a pancake coil of wire mounted 
on an insulator. The coil/insulator is packaged into a transducer housing. 
External electrical connections are made by the use of a high pressure type 
cryogenic electrical coaxial connector, which will be welded to the transducer 
case to provide a positive pressure seal. The length of the shank of the trans- 
ducer housing is of a controlled length and the sensor is designed to be properly 
gapped when bolted to the mounting boss on the pump inducer housing. A Dynatube 
seal is used to seal the transducer at the mounting boss on the inducer housing. 
Probes will be designed to be compatible with fuel and LOX and will be of flight 
weight. — 

The external circuitry (figure IV-9) consists of an RF generator, two 
demodulators, and a comparator. Basically, one demodulator (No. 2) demodu- 
lates the constant output of the RF generator to provide a reference dc voltage 
level at one input to the comparator. The probe and load resistor (R) are in 
series and are excited by the constant output RF signal from the generator. As 
a pump blade passes in proximity to the sensor, eddy current effects change the 
impedance of the probe resulting in a change in the voltage developed across the 
load resistor. This signal is demodulated by demodulator No. 1, producing 
pulses in its output. This signal is fed to the input to the comparator. When the 
signal at the comparator inputs from demodulator No. 1 exceeds the re ference 
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signal from demodulator No. 2 (both signals adjustable by voltage dividers), the 
comparator triggers, producing a 5 vdc output signal. When the voltage levels 
between both demodulators reverse (as the blade leaves the vicinity of the sensor 
tip), the comparator drops out and its output falls to 0 vdc. Thus, a series of 
0 to 5 vdc pulses are produced, corresponding to the pump blade passing 
frequency. 


Table TV -6. Speed Sensor Comparison 


Advantages Disadvantages 

Speed measurement can 
be made from the non- 


Type of System 


Inductive proximity 
principle type eddy 
current sensor 


magnetic pump blades 

Output of sensor is 
essentially constant 
over all pump speed 
ranges 


External RF oscillator/ 
demodulator circuitry 
required 

Working with RF signals 


Insensitive to changes 
in dielectric between 
sensors and blade 


Anticipated that only a 
10 to 20% decrease in 
amplitude of output 
signal will occur with 
temperature changes 
from ambient to LH 2 

Similar system used 
successfully on 250K 
Fuel Pump Program 

Output is insensitive to 
lateral shifts between 
the sensor and the blade 


Self- generating magnetic No external RF cir- 
principle eddy current cuitry required 
sensor 


Size is too large to adapt 
to pump housing designs 


Signal is self- Output is a function of 

generating _ _ peripheral speed of blades 

External pulse shaping 
required 


Amplitude of output signal 
is lower than with other 
type of speed sensors 


Table IV -6. Speed Sensor Comparison (Continued) 


Type of System 

Advantages 

Disadvantages 

Elect romagne tic 

Signal is self- 
generating 

Will not sense the nonmag- 
netic pump blades. To 
obtain a signal, magnetic 
materials would have to be 
incorporated in the pump 
blades, or a separate mag- 
netic speed gear incorporated 
in the pump design 


Less complicated 
system electrically 

Magnetic speed gears and 
sensors were used on the 
350K LOX and Fuel Pump 
Program. Many speed prob- 
lems occurred due to radial 
vibration and axial shifts in 
the speed gear (the gear was 
driven from the turbine). 


• 

The amplitude of the output 
signal varies with rpm and 
temperature. 

Capacitive 

Will sense nonmagnetic 
metals 

Extraneous signals can be 
produced by variations in 
the dielectric between the 
sensor and the blades (such 
as variations in density, 
temp, etc. , of LH 2 and LOX). 

* 


External RF oscillator/ 
demodulator circuitry 
required. 
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Figure IV-9. Inductive Proximity Principle 
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external circuitry will be miniaturized and designed for flight weight 
mere possible, systems components will be interchangeable within established 
mits The same basic speed sensor system design will be used for both the 
fuel and LOX pumps. The pump housing configuration dictates the use of at 
least two different lengths of probes. 


r.Hh JIT S °i SyStems wil1 ^ “sed per pump to provide redundancy. 

Calibration of the speed sensor systems will be conducted in a test bench that 
simulates actual engine conditions. This will include a spin rig and facilities 
to tune the systems with the probes at LN2 temperature. 


3. Requirements 

Speed sensor design requirements are presented in table IV-7. 
Table IV-7. Speed Sensor Design Requirements 


Parameter 
Temperature Range 

Pressure 

Compatibility 

Response 

*r 

Uncert linty 
Environmental 

Probes and external electronics must 
be of fligjbtw’eight 

Range 

e- • - 

Exciter Blade Thickness 
Exciter Blade Material 
Maximum Envelope 

4. Capability 


Requirement 

36° R to +590° R (probes) 

395 R to +590°R (RF generator/ 
demodulator circuitry) 

700 psi max (probes) 

0 to 15 psia (RF generator/demodulator 
circuitry) 

Probes must be fuel and LOX compatible 
5K Hz (50, 000 rpm) 

±1 pulse 

Meet all CEI and ICD requirements. 

0 to 0. 080 in. 

0. 060 in. 

Titanium or Super A-286 (nonmagnetic) 
As defined by SXIL 11742 


tn annn he - Pr °^ S C ? n U ? ed at tem P era *ures from 3G°R to 860° R at pressures 
rpmiipp * ?lectlonics for the detector drivers can meet specification 
requirements for temperatures of 395° R to 710° R. The system design response 
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is 3 db down at TBD KHz. The amplitude output of the system is designed to be 
constant from 0 to TBD KHz. The output of the system is insensitive to lateral 
shifts between the sensor and the blade. 


5. Substantiation 


r 

\ 




l 


The inductive proximity eddy current speed sensor has demonstrated 
reliable output at cryogenic temperature and engine environment in test stand 
installation on the XLR129 fuel pumps. A total of 2037 sec of probe run time 
was accumulated during these tests in which the probes were in a 150 psi LHo 
environment. Speeds of above 40, 000 rpm were measured. 

Other inductive proximity eddy current speed sensor systems have been 
used at P&WA in the following applications: 

. • Radial Turbine - 0 to 65. 000 rpm, 300° F air, measurement made 
from a 6-tooth splined shaft 


• ST 9 Engine and High Compressor Rig - 0 to 37,500 rpm, 150° F air, 
measurement made from a single weld bead to give IE signal for use 
in making vibration trim balance 

• JT11 A/B Turbopump - 0 to 40, 000 rpm, 400° F air, measurement 
made from the 53 turbine blades 

• JT11 Bearing Rig - 0 to 4000 rpm, 550° F oil, measurement made 

from three pins in bearing cage 

- • Western Gear Box - 0 to 5000 rpm, 

from two slots in journal bearing. 

G. ' ' HIGH RESPONSE PRESSURE SENSORS 

* 1. * Introduction 

Dynamic pressure measurements are required to ascertain combustion 
stability. Combustion stability is defined by the CEI Specification and is described 
fn terms of the time for any dynamic pressure exceeding 5% of the maximum 
chamber pressure to decay. These dynamic pressures will be measured during 
normal and disturbed (bomb injected) performance tests. 

2. Description ~ " 


150° F oil, measurement made 


Hydrogen-cooled Kistler transducers will measure dynamic pressures in 
hydrogen-filled "infinite length" tubes. Each tube will lead to the CEI Specifica- 
tion six required locations in the preburner and main chamber. The concept is 
shown in figure IV-10. 


The long length of tubing from the chamber sense point prevents interfering 
reflections of dynamic pressure from the tube end. Reflections are made insig- 
nificant by the viscous damping of the hydrogen against the tube walls and by the 
wire packing at the tube end. The transducer monitors the dynamic pressure 
transmitted through the hydrogen filled tube at the pneumatic tee (figure IV- 11). 
The tee is located as close to the sense point as possible to minimize wave dis- 
tortion at high frequencies and frequency doubling of all frequencies. 
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The Kistler Model 615H Probe Assembly consists of a quartz pressure 
sensor and electrical and pneumatic fittings. The pneumatic fitting allows dry 
hydrogen to be bled into the infinite tube. The hydrogen flow will keep the 
infinite tube free of combustion water by absorption, will cool the tube at the 
chamber sense point, and also cool the quartz sensor. The signal cable from the 
quartz sensor to the charge amplifier will be kept to a maximum length of 5 ft 
to maintain the required frequency response. A Kistler Model 566 charge ampli- 
fier will be modified to operate on 28 vdc. The modified amplifier will be shock- 
mounted to the canister containing the infinite tube. 

3. Requirements 

The following design requirements apply to the sense point: 

Temperature - Maximum 3400° R 
Pressure - Maximum 6023 psia 
Dynamic Pressure - 50 to 2000 psi p-p 
Response - 10 to 15,000 Hz 

Uncertainty - ±20% of avg sensitivity over response band 

Structural - Meets all CEI and XCD requirements (Refer to PWA FR-4377, 
drawing No. L222193 and L222158) 

4. Capability 

The infinite tube system meets the design requirements established by the 
CEI specification, but may have a narrower response band than anticipated 
caused by the entry of combustion products into the system. The amount, if any, 
of the possible response band reduction is no known, nor can it be estimated. 
However, for any remote transducer mounting technique, the infinite tube 
system gives the widest response band. 

Expected measurement performance shows the pressure range to exceed 
the requirements; combined maximum pressure = 10,000 psia, maximum 
dynamic pressure = 8000 psi p-p. 

5. Substantiation 

The infinite (length) tube measurement technique (References 1, 2 and 3) 
was selected as the better of two remote pressure transducer mounting 
methods. The selection of remote transducer mounting was made over flush- 
mounted, cooled transducers. Flush mounted cooled transducers are 
currently too large and would disrupt engine cooling when absent during flight. 
The remotely mounted transducer at the end of a short tube is resonant like 
an organ pipe (Reference 4). The resonant frequencies for this application 
occur in the upper half of the frequency response requirement. The infinitely 
long tube does not resonate because there is no surface to reflect the pressure 
wave back to its origin (Reference 5). The transducer mounted off the tube 
centerline in a small cavity resembles a Helmholtz resonator (Reference 6). 

This resonator will absorb the frequencies about which it is resonant and 
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reflect them to the origin (Reference 7). This resonant frequency can be 
made quite high. With hydrogen filling the transducer cavity and using data 
supplied by Kistler Instrument, the proposed design will resonate pneumatically 
above 45,000 Hz. This is a definite improvement and the basis for the use of 
the tube that appears infinitely long. 

The transducer, Kistler Model 615H, is a variation of the Kistler Model 
615A (Reference 8). The Kistler 615A has been used more than 100 times to 
measure the dynamic pressure in the precombustion and the combustion 
-chambers during rocket engine component testing (Reference 9). It has been 
found to conform to all expected requirements. The hydrogen bled through 
the transducer will provide an absorber for water vapor, exhausting it into 
the combustion chamber. If a flight requirement evolves because of combustion 
problems, which is doubtful, the following alternative will be thoroughly 
investigated. 

A miniature high pressure transducer, manufactured by Kulite Semicon- 
ductor, will be available in late 1971. It may be possible that l/8-in, diameter 
cooled hydrogen bleed transducer could be constructed for chamber surface 
mounting. It would eliminate the uncertain response and extensive testing, 
required to certify data influenced by tube response. Prior to acceptance * the 
transducer will require testing in a rocket chamber environment as well as 
standard pressure calibration. 

Dynamic pressure transducers have to he individually calibrated to 
meet the uncertainty requirement. For the Kistler, the initial dynamic pressure 
sensitivity is determined from a known pressure step. The step is generated 
by venting a pressurized manifold. Manifold pressure is measured with an 
Acco Helicoid gage (traceable to NPS). The transducer output signal is 
amplified with a Kistler Model 566 charge amplifier, and the amplifier output 
applied to a 5 digit DVM. Additional calibration will be done to verify 
frequency response. A primary source of information is the resonant 
frequency and damping of the transducer, as obtained from shock tube testing. 

Results of this testing would define the frequency response from 150 Hz to 
resonance with the equipment to record the transient record with high 
resolution. Secondary testing using a high amplitude dynamic pressure testing 
system (Reference 10) and an acoustic impedance tube will deliver pressures 
at 171 db SPL and 124 db SPL, respectively, for transfer calibration. A 
Statham PA856 transducer will also be tested on these systems for comparison 
to the Kistler. Verification of frequency response will require agreement 
within each transducer data set as well as agreement between data sets. The 
first transducers to agree within 2% will be established as reference 
transducer. It should be noted that the high amplitude dynamic pressure 
testing is currently limited to 10 KHz frequencies and lower. Additional 
accessory equipment will be necessary to extend the test frequencies through 
15 KHz at fixed frequencies. Fluidic oscillators of this type are commercially 
available. 

Other testing will compare the infinite tube system to a dynamically 
calibrated Kistler, when simultaneously mounted on a rocket engine combustion 
chamber, to examine the infinite tube response at realistic pressure levels. 

The inflax of combustion products and the possible effect on the frequency 
response band would be determined. 


H. ABSOLUTE PRESSURE SENSORS 

I. Introduction 

Cryogenic and high temperature versions of the Statham Model PA822 
absolute pressure sensor will be used to measure pressures throughout the 
SSME. The sensor's small size, light weight, and superior operating 
characteristics meet the SSME Design Goals. 

Preburner and Main Chamber pressures will be measured using the 
high temperature version for performance analysis and to control thrust. 
Cryogenic versions of the sensor will be used to monitor NPSP and to 
enable calculation of density at the propellant flowmeters. Other cryogenic 
pressure sensors will provide pressure indications in the helium system, 
fuel and oxidizer turbopump inlet and discharge, and transpiration cooling 
value inlet and discharge. 

2. Description 


The high and low temperature versions of the sensor are identical 
except for the thermal compensation. Both utilize a vacuum deposited thin 
film strain gage bridge as the sensing element. This type sensing element 
has the good features of a bonded strain gage bridge while eliminating the 
bad characteristics associated with bonding cements. 


The sensor pressure connection will be modified to incorporate a 
Pvnatube ™ pressure seal. Sensor wiring will terminate in a hermetically 
sealed connector, which will mate v'ith the engine harness (figure IV-12). 
Proof pressure of the sensors will be 150% of the rated sensor range. 

All sensors will be calibrated in accordance with the Quality Assurance 
.Verification Analysis Report, PWA FR-4066. Sensors of the same pressure 
and temperature range will be interchangeable. 



0.065-0.075 Dia Lockwire Holes - 3 Locations 

Nut aod Seal to Be Dimensioned Per L-222101 
Except as Shown - 16 Dynatube Threaded 
Connector 1.250-16 UNJ-3A Thread - 



Retaining Ring 

Electrical Connector Per MSFC 
40M39569 To Mate With NBGE-10-6S 


Figure IV-12. Absolute Pressure Sensor 
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This type sensor was selected for its superior capabilities and past 
performance, as detailed in the Avionics Trade Studies, PWA FR-4439. 

3. Requirements 

The following requirements apply to the absolute pressure sensors. 
. Pressure Ranges 
Cryogenic 
High Temperature 
Maintainability 


Temperature 

Long Term Precision, 
Including Interchangeability 


Response 

Structural 


4. Capability 

Sensors presently in use demonstrate the reliability and accurac}' 
required at all ranges. Sensor response is within the design goal of 100 Hz, 
and with well designed installations will meet all requirements. Sensor long 
term precision requirements will be met using environmental conditioning 
where required (table IV-7). 

5. Substantiation 

More than 3000 pressure sensors are in active service P&WA, many 
of which are similar to those selected for the SSME. During 1970, only 
82 out of 2600 engine-mounted sensors failed. These included all pressure 
ranges, at temperatures from cryogenic to hot gases. The sensor selected, 
Statham Model PA822, has been exhaustively tested in the laboratory and 
on operating turbojet engines. 

I. CRYOGENIC DIFFERENTIAL PRESSURE SENSOR 
1. Introduction 


0-50 to 0-7500 psia 

0-3500 and 0-6000 psia 

System must allow field replace- 
ment of sensor without disassembly 
of any portion of the engine or 
recalibration. 

39 to 2000°R (at the sense point). 

1.0% full scale for main chamber 
pressure and 1.2% full scale f or 
all others. 

100 Hz 

Meet all CEI and ICD structural 
and environmental requirements. 


/ 


Accurate measurement of propellant flow rates are required to establish 
the mixture ratio of the SSME. A low loss flow tube, which is a head— type 
flowmeter, is described in Section IV A. To measure flow rate with a head 










Table IV- 7. 


Precision Determination For Statham PA822 
Absolute Pressure Sensor 


Source of Errcr 

Error. % Full Scale 
Main Chamber Pressure All Others 

Nonlinearity 

« ±0.30 

±0.30 

Hysteresis 

±0.10 

±0.10 

Thermal zero shift (±20°R) 

±0.20 

±0.20 

Thermal sensitivity shift (±20°R) 

±0.20 

±0.20 

Zero stability 

±0.10 

±0.10 

Sensitivity stability 

±0.10 

±0.10 

Excitation drift 

±0.05 

±0.05 

-Vibration 

"±0.20 

±0.20 

Acceleration 

• ±0.04 

±0.04 

_End point tolerance (interchange- 
ability) 

- ±0.50 

±1.00 

/ - • r*. . . » - 

Long term precision, including 
interchangeability 

±0.70 

±1.115 


meter, which provides a pressure drop proportional to the flow, a differential 
pressure measurement between the meter upstream pressure and the meter 
throat pressure is required. ~ t 


Accuracy limitations and system complexity of two absolute pressure 
sensors to determine the differential pressure are inconsistent with the 
engine design goals. The relatively low absolute pressure levels (less than 
500 psia) between the turbopumps allows use of a lightweight cryogenic 
differential pressure sensor. The MB Electronics Model 203 Cryogenic 
Differential Pressure Sensor is selected for this application. 

- - 

2. Description 

The source of pressure is an annulus around the upstream and throat 
section of a low loss flow tube. Two sets of pressure taps are provided in 
ach annulus for redundancy. Differential pressure sensors are available 
for the pressures to be encountered. The design of most of these sensors, 
however, precludes their use with cryogenics because the sensing element 
xie either immersed in the pressure media or the sensor contains an oil fill. 

The MB Electronics Model 203 sensor utilizes two diaphragms, which 
are each exposed on one side to the pressure media. These diaphragms 
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are separated by a sealed cavity. A strain gage bridge is isolated from the 
pressure media within this cavity which measures the stress on a beam 
mechanically actuated by the two diaphragms. 

A Dyhatube pressure seal will be incorporated with the unit. 

The sensor wiring is hermetically sealed in the connector which mates with 
the engine harness (figure IV-13). 



The sensor will be mounted on and heat sinked to the flow tube to 

provide thermal stability. Calibration of individual sensors will be 
accomplished by PWA using procedures described in the Quality Assurance 
and Verification Report, PWA FR-4066. Sensors of the same range will 
be interchangeable. This type sensor was selected for its superior 
capabilities, as detailed in the Avionics Trade Studies, PWA FR-4439. 

3. Requirements 

Table IV- 8 presents the requirements that apply to selection of a 
cryogenic differential pressure sensor. 


Table IV-8. Cryogenic Differential Pressure Sensor Requirements 


Parameter 
Pressure Range 
Line Pressure 
Temperature 


Fuel 

8. 5 to 48 psid 

110 to 265 psia 

39 to 46°R 
IV-29 


Oxidizer 
19 to 95 psid 
80 to 460 psia 
163 to 174°R 



Table IV-8. Cryogenic Differential Pressure Sensor Requirements (Continued) 


Parameter 

Fuel 

Oxidizer 

Long Term Precision, 

±1.2% full scale 

±1.2% full scale 

Including Interchangeability 



Response 

100 Hz 

100 Hz 


Structural must meet all CEI and ICD structural and environmental 
requirements. 

Maintainability - system must allow field replacement without disassembly 
of any portion of the engine. 


4. Capability 

The cryogenic differential pressure sensor selected can be fabricated 
in the ranges required, has a line pressure rating of 1000 psia, and a burst 
pressure rating of 5000 psia. The sensing diaphragms and all surfaces 
exposed to the pressure media are compatible with liquid hydrogen and 
liquid oxygen. 

The sensors’ frequency response meets the requirement and proper 
installation will enable the data requirement to be met. A sensor long term 
precision, including interchangeability, of ±0.73% full scale will be met 
by heat sinking the sensor to the flow tube. 

5. Substantiation . — - - - 


r* More than 3000 pressure sensors are in active use at P&WA, many 
of -which are similar to the selected sensor. These sensors are calibrated 
and maintained inliouse. Sensors similar to that chosen have been used in 
both the RL10 and XLR129 programs. 

A sensor long term precision, including interchangeability, of ±0.73% 
full scale (table IV- 9) will be available through improved manufacturing 
techniques and selection of the more accurate sensors for this application. 
Vendor coordination and sensor selection methods have been used successfully 
in the past to improve sensor precision. 

Table IV-9. Precision Determination For MB Electronics Mode 203 
Differential Pressure Sensor 


Source of Error Error, % Full Scale 


Uonlinearity 

Hysteresis 

Ibermal zero shift (±10°R) 
l IV-30 


±0.30 

± 0.20 

± 0.10 


t 





c . 

j 


c» 


Pratt & Whitney Pircraft 
PWA FR-4249 
Volume II 


Table IV-9. Precision Determination For MB Electronics Mode 203 
Differential Pressure Sensor (Continued) 


Source of Error 

Error, % Full Scale 

Thermal sensitivity shift (±10°R) 

±0.10 

Zero stability 

±0.10 

Sensitivity stability 

±0.10 

Excitation drift 

±0.05 

Zero shift with line pressure 

±0.25 

Vibration 

±0.20 

Acceleration 

±0.04 

End point tolerance (interchangeability) 

±0.50 

Long term precision, including interchangeability 

±0.73 


£*: r r_ r . £ • • 
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SECTION V 

ELECTRICAL SYSTEM 


A. ELECTRICAL HARNESSES 

1. Introduction 

The SSME engine is controlled with a digital electronic controller (ECU). 
Wiring harnesses are required to conduct electrical power and signal information 
between the vehicle electrical interface panel and the ECU, and between the 
ECU and the engine sensors, effectors, and ignition systems. 

2. Description 

Nine harnesses conduct 115 vac power, 28 vdc power, digital data bus 
signals, and nonflight sensor excitation power and signals between the interface 
pane' and the ECU. Sixteen harnesses conduct power and signal information 
between the ECU and various engine components on a booster engine. The 
orbiter engine requires two additional harnesses between the ECU and the 
nozzle drive system. Twenty-five harnesses are required for a booster engine, 
27 for an orbiter engine (figures V-l and V-2). 

The harnesses conduct power from the ECU to the engine components in 
the following forms: 115 vac for ignition systems, 28 vdc for solenoids, and 
5 vdc conditioned for sensor excitation. Information and command signals 
conducted are millivolt sensor output signals, millamp torque motor signals, 

Irgh frequency speed and vibration sensor output signals, and digital data bus 
signals. Compatible signals are grouped in harnesses on the basis of signal 
voltage level and frequencv content, and similarity of mechanical use. 

Redundant harnesses preclude the affects of single failures. Harnesses must 
conduct signals faithfully in the engine environment to assure reliable engine 
operation. 

Harnesses are designed ' available electrical parts and materials to 
conduct signals and power without allowing signal degradation or electrical 
interference with other electrical systems. 

Standed nickel plated conductors, per Mil-W-2275, are used throughout 
the system. All conductors are wire-size 20 or larger. Conductors are twisted 
to minimize susceptability to EMI and, covered with extruded polytetrafluor- 
ethytene (TFE) insulation reinforced with abraisive resistant mineral filler. 

The 28 vdc main power cable uses three size 12 wires and contacts to 
carry the maximum anticipated current of 30 amps. The No. 12 wire size, 
normally rated at 23 amps, has been derated to conduct a maximum 11 amps 
in the space environment. 

Each twisted pair (individual signal) is shielded in a nickel-coated copper 
braid, per Mil-C-27500 Symbol N, to protect from low frequency ground loops. 
The shield is then covered with extruded or tape TFE, per Mil-C-275000 
Symbol C. 
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Figure V-l. Electrical Wiring Harness, Booster 
V-2 
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NON- FLIGHT DATA 
ACQUSITION CONNECTOR CONTt) 


ENGJFC 


rCCMMASO INPUT TO ECU.- SIGNAL PROM EXTERNAL 

BAILABLE WLAvETEAS Pr:m E.C.U-SlcNAi TO EXTERNAL 
RETURN 


FOR SPECIFIC PARAMETERS. COMMANDS AND 
ELECTRICAL TRANSMITTING data 
SEE INTERFACE DOCUMENT FR 4*9 


CWtOtfC* PvJW> l#TOFF SEALS Ol.aawOlZEA p 0YNM4C SEAL* 3 3 
actjrn 

*«lo 9 

P RfBJHCR P*MARY PURGE — — 34 

HETJiN 

SM€LO O 

prc burner secokwry purge 3§ 

RETURN 

SHCLD 9 

MAN BURNER **<* 33 
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SMCLD 9 

ENGPC VALVE ACTUATORS 37 

RETURN 

SH*LO 9 
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NON -FLIGHT DATA 
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-LOW PRESSURE OMOZCR PIMP NLET PRESSURE 
31-^n^ - 


-»♦>< PRESSURE OxOZER PUMP INLET PRESSURE-- 
-R E”JRN 

- Sh*CL 0 

- >ozer flowmeter ap 

-return 

-^AELD 

-*o* presslfe oxozer (\*p oischarge pressure - 

-RE TuPN 

-*<LD 

-LOR PRESSURE FUEL PUMP INLET PRESSURE 

-*£’L*N 

-*«L0 -- - - 
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AP 
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- 9CL0 
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-9<L0 
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Figure V-2. Electrical Wiring Harness, Orblter 
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NON- FLIGHT DATA 
ACQUISITION CONNECTOR CONTD 


OXOZER PUMP UFTOFF SfcAi.S(3>. ft OXlOl.TER PUMP DYNAMC SEAL- 33 
■PfTLPN 

■ SHtCLD ^ 

■PWEBURNER PRIMARY PURGE 94 

■RETURN 

■SmiClO 9 

•PREBuRfCR SECONDARY PURGE — 99 

•return 

• SHIELD Q 

■MAIN BURNER PURGE 9€ 

■ RE TURN 

■SHIELD Q 

•ENGINE VALVE ACTUATOR- 97 

■RETURN 

SHiELO 9 

•FUEL HKX PRESSURE T**80P>* JF r Off SEAL HYOROGEN SUPPLY 36 
■RCTLWN 

- SHCLD 9 

-FUEL HIGH PRESSURE TURBO**.** UF TO FF SEAL - 99 

■RETURN 

-SHIELD 

-PREBURNER OXKMER REOROJLA'ON AL-VE POSITION 40 

■RETURN 

■SHiELO 

-Fuel recirculation valve pcs-tx* — 4i 

-RETURN 

-SHCLO 

-MAM OxiOiZER REORCULATCN A^.{ POSITION 42 

■RETURN 

■SHCLO 

-EXTEWlBLE NOZZLE POSiTCN 43 

-RETURN 

-SHCLD 

•CXTENO«LE NOZZLE L OCX. -AC* SCREW PI — 44 

■return 

SHCLD 

-EX TENO«LE NOZZLE uOCK. >ACxSCRE« »2 45 

-RETURN 

-SHlE'.O 

-EXTEfOBLE NOZZLE LOCK. ^ACKSCREW R 9 - 46 

-RETURN 

-SHIE.0 


r DATA 

hCOMMANO INPUT TO E.C.U.- SIGNAL FROM EXTERNAL 

^available parameters from e.c.u.- signal to externa. 

RETURN 


FOR SPECIFIC »*4*rT35. COMMAS ANC 
ELECTRON. *AA\SM"NG ZA TA 
SEE INTERNE 2CJtf*r FR-4i69 


REDUNDANT CONNECTOR- SAME AS INTERFACE CONNECTOR * *» 
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RETURN 


■REDUNOAN r CONNECTOR SAME AS INTERFACE CONNECTOR *1 


MAIN CHAMBER PRESSURE -HIGH FREQUENCY RESPONSE -SiGNA. *C f*T£RNAL 

RETURN 
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I RE T vjRN 


O SOLENOID POSITION 


■REDUNDANT TRANSMISSION-SAME AS CONTACTS A-M 


BfOUICANT SlONAL- SAME AS PIN b 
RETURN 
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The shields are taped together with TFE, tying a neat bundle which 
insulates the shields from each other and the outside braid, and acts as a 
cushion under the outer braid. 

A magnetic stainless steel braid, per Mil-C-7078B, is then stretched 
over the bundle, providing protection from magnetic interference, EMI and 
mechanical damage. 

Environmental bayonet connectors, per MSFC 40M39569, are used where 
compatible with the environment and the application. The connector uses crimp 
contacts, per MSFC 40M395'<0, which are inserted from the rear. This cont- 
taet, retention clip, and assembly method provides a reliable assembly. 

Damage to resilient insert fronts, which are interfacial seals, is eliminated 
since they are not touched during assembly. A positive lock is engaged when 
the connector is properly mated. 

Ground loop shields are terminated by crimping a ferrule, per Mil-E- 
45782, to a conductor, which in turn is crimped to a connector pin. 

The overbraid is terminated with a backshell adapter, per MSFC 40M38260, 
which threads to the connector shell and clamps the overbraid. The adapter 
serves two purposes: to provide stnin relief for the electrical connections and 
to assure that the EMI protection afforded by the overbraid is continuous to 
the connector interface. The backshell contains a 3/16 in. -diameter hole 
through which potting compound may be injected. The potting compound fills 
the void between the connector backshell and provides resistance to moisture 
and vibration (figure V-3). 

3. Requirements and Capability 

Electrical harnesses are designed in compliance with CEI Specification 
No. CP2291. A wiring harness specfication is prepared for NASA approval. 

Environment electrical connectors, per MSFC 40M39569, are used where 
compatible with the environment arc. the application. A substitution is required 
for chromel alumel and platinum rhodium thermocouple circuits and sensors which 
require coaxial circuits. 

Good design practice dictates foolproofing. The harness facilitates 
foolproofing through selective routing. 

Harness life must exceed 7. 5 hr. Harnesses that gimbal may be expected 
to have life characteristics different from harnesses that do not gimbal. Elements 
that must gimbal are harnessed together. 

Redundant harnesses preclude the affects of single point failures. Any 
single harness may be removed without affecting engine operation. 

Harnesses must endure the engine thermal environment, which varies from 
-360*F to +392°F. Materials used throughout the harness are compatible with 
the temperature range, with the exception of the electrical connectors. Environ- 
mental connectors, per MSFC 40M39569, are qualified to the temperature range 
of -148 °F to +392 °F. Connector operational temperatures are expected to vary 
from -120° F to +392° F, which is within the specification qualification temperature 
range. However, nonoperaiional temperatures are expected to be as low as 
-360° F and passive connector capability will have to be verified by test. 
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Figure 11-14. Protection Loops 





Table II-l. Glossary of Terms for Figure 11-12 


Input Commands, Mixture Ratio and Thrust Level Servos, 
Start and Shutdown Logic 


Name 

Description 

Value 

Units 

* 

Mixture Ratio Velocity Servo 

OFR 

ratio 

A1 

Servo integrator schedule (described 
by GOFS, ± VOF) 

sec 



10.0 

ratio/sec 

GOFS 

Integrator velocity gain 

ratio 

VOF 

Integrator velocity limit 

*1.0 

ratio/sec 

A2 

Mixture ratio acceleration bias 
(b ear to AVMAX, limited at 
0. 0 and 1.0) 

AC DF 

unities s 


OFACEL 

Acceleration mixture ratio 

6.0 

ratio 

A3 

Start and shutdown mixture signal 

OFSTSD 

ratio 

for schedules (HI (start), LO (shut- 

HI = 6.5 



down) 

LO = 5.5 



Thrust Velocity Servo 



Bl 

Servo integrator schedule (descrioed 
by GTL, ±V) 

TLRV 

%/sec 

GTL 

Integrator velocity gain 

20.0 

%/sec 

cv 

/o 

B2 

Integrator velocity limit schedule 
(described by AVMAX, DVMAX, and 

V 

%/ sec 


a start and shutdown velocity 



AVMAX 

Maximum acceleration velocity limit 

60. 0 

%/sec 

DVMAX 

Maximum deceleration velocity limit 

80.0 

%/sec 

B3 

Schedule reset acceleration bias 

AC 

unities s 

(linear, limited at AVMAX to AAC, 
limited at -DVMAX to -DAC) 




AAC 

Maximum acceleration bias reset 

1.0 

unit less 

DAC 

Maximum deceleration bias reset 

0.6 

unitlcss 

TACB 

Reset acceleration bias time constant 

0 . 1 

sec 
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J. START AND SHUTDOWN OPERATION PROVIDED 
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Engine Requirements Dictate Functional Needs 


Three functional requirements are prescribed for the control system for 
safe engine start and shutdown: 


Prevent start procedure until the engine is readied fo*' start 


Provide time based sequence control of valves and solenoids 
through the start and shutdown region 


Shut engine down safely in the event of an improper start 


Permissive Circuits Authorize Start and Shutdown 


All start requirements must be satisfied before start initiation can begin 
When the engine purges, etc. , are complete and the engine is ready to start, 
an engine ready signal is generated and sent to the vehicle. With thrust and 
mixture ratio command signals present and the engine in readiness, a start 
pulse will lock the permissive circuit on, initiating start by closing a switch 
which supplies the thrust command signal to the servo. Either a shutdown 
pulse or commanding a thrust level below 50% will cause automatic shutdown. 


3. Flexibility Inherent in Design 


A rate controlled signal from the thrust level servo delivered simul- 
taneously to both the start and shutdown schedules provides a time base for 
the schedules. As a function of the input and velocity error signal level, start 
and shutdown operations can be separately sequenced and controlled at definite 
rates. Figure II —9 shows how the schedules for the valves and solenoids are 
selected for start or shutdown. 
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Figure II— 1 1 . Control System Block Diagram Organization 
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4.0 


Substantiation 


Harnesses similar in construction to the SSME harness have demonstrated 
life in excess of 100 hr during component qualification testing of the PWA 
TF30P-100 engine (Fill aircraft). The electrical harness environmental tempera- 
ture was maintained at +350°F for 99 hr and 450°F for 1 hr. Low temperature 
operational capability was demonstrated as evidenced by successful PFRT 
testing of the RL10A1 engine flight instrumentation harness. 

A digital controller and harness similar to the ECU and SSME harness 
are tested to EMI requirements in excess of Mil-Std-461 and 462 in the 
F100-PW-100 turbojet engine program. Preliminary tests indicate that the 
system vail meet the requirements, in addition, electrical harnesses have 
operated on this engine in excess of 185 hr. 

B. ELECTRICAL IGNITION SYSTEM 

1. Description 

The electrical ignition system for the SSME consists of an integral 
exciter and plug as shown in figure V-4. Four identical systems are 
used on each engine; two for the prebnmer torch and two for the main chamber 
torch. 


The exciter is designed to be energized by single phase, 115 v. 400 Hz 
alternating current. It is a capacitor discharge type, providing a 10 Kv nominal 
output to an unshunted, surface gap spark igniter. The minimum spark energy 
will be 45 millijoules, delivered at a rate of 100 sparks per second minimum. 
The operational duty cycle will be 5 sec on and 120 sec off. 

A monitor circuit is provided in each exciter for connection to the engine 
command unit. This circuit provides an output indication of spark discharge. 

It is energized by a pickup coil placed around the high tension output lead 
adjacent to its connection to the center electrode of the spark plug. This 
location provides the most direct indication of ignition system operation within 
the exciter housing. 

The exciter will be pressurized to 10 psig. An internal pressure 
indicator pro/ided on the exciter is a restrained bellows that can be inspected 
visually to determine if the exciter has lost its internal pressure through 
leakage. A measurement of the bellows position is also possible to determine 
the internal pressure. This feature, in addition to the monitored spark out- 
put, will provide assurance that the exciters will operate during the space shuttle 
launch as required. 

The igniter will have a double pressure seal between the exciter interior 
and the igniter tip. These seals are located a maximum distance from the 
electrodes to minimize thermal gradients across the seals. A circular flange 
is provided around the junction of the exciter and tne igniter body. 


V-6 



(AH Dimensions in Inches) 


i 

Figure y-4. Ignition System Outline 
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The construction of the integral pressure indicator for the exciter is 
shown in figure V-5. This is a simple device consisting of an annular bellov/s 
welded to the exciter end cover with an open-end restraining housing. A 
hole through the exciter end cover transfers the internal pressure of the exciter 
to the bellows. A collapse of the bellows will show that the exciter pressure 
has dropped due to air leakage. An air pressure measurement may also be 
made on the exposed bellows end. 

The completed exciter will be tested for maximum air leakage of 
lx 10-9 cc per sec of helium. A small tube on the end cover next to the 
mounting flange will be used for back filling the exciter to 10 psig internal 
air pressure after which the tube will be crimped and sealed by welding. 





Figure V-5. Exciter Pressure Indicator FD 52632 

The exciter is divided into two separate areas as shown in the center 
cross section ot figure V-6. The RFI filter components are contained in a 
sealed housing attached to the excite.' and cover. The remaining components 
are located below the filter and around the igniter plug terminal. Electrical 
connections between the two areas are made with feed-through capacitors 
attached to the filter cover. 

Positioning of the components in the mam assembly area of the exciter is 
accomplished by molding and insulating support blocks. This molded block will 
be made of a silicon compound having glass microbeads as a filler. The storage 
capacitors, item 30, high frequency capacitor, item 1, are molded in the 
block, and port holes are provided for the remaining components. 

An electrical schematic for the 10-392480-1 ignition system is provided 
in figure V-7. 


When 1.1 5- vo It, 400-Hz power is connected to terminals A and B in the 
input connector, current will flow through filter coil LI, feed-through capaci- 
tor C3, the primary winding of power transformer Tl, feed-through capacitor 
C4 and filter coil L2. The alternating current input induces an alternating 
current flow in the secondary of Tl. The turns ratio of Tl steps up the voltage 
across the secondary. 
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Figure V-6. Ignition System Design 
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When the top of the secondary is positive in respect to the bottom, 
current will flow to rectifier Dl, resistor Rl, and charge the top plate of 
storage capacitor C5. The circuit is completed by current flow back from 
the bottom of C5 and the top of C6 to the bottom of the secondary. This places 
a charge on the top plate C6 equal to the top plate of C5. 

When the top of the secondary is negative, the current will flow from the 
positive bottom of the secondary to the bottom plate of C5 and the top plate of 
C6 to ground. It then flows through Resistor R2, rectifier D2, and to the top 
of the secondary. Storage capacitors C5 and C6 are thus charged in steps on 
alternating half cycles. 

As the charge increases on *he storage capacitors, sp 'k gap, G, and 
igniter plug, P, electrodes become ionized. When the voltage across C5 and 
C6 reaches a predetermined value, this ionization produces a low resistance 
span across G and P, allowing the electrical energy stored in C5 and C6 to 
discharge very rapidly to provide 45 millijoule spark energy release across 
the igniter plug electrodes. 

High frequency capacitor C7 is also charged in parallel with C5 and C6. 
When the spark gap conducts, a high frequency pulse flows through the primary 
of output transformer P2. This induces a very high voltage pulse across the 
secondary of P2 during the first portion of the discharge current flow to the 
igniter plug. This high voltage pulse fully ionizes the igniter plug electrode 
and allows the stored energy to discharge as a sp' *k. This charging and dis- 
charging of the storage capacitor continues to provide a succes^on of sparks 
to the igniter plug until the input power is disconnected. 

A third electrode provided in G stabilizes the discharge across the main 
electrodes by the voltage drop across resistor R3. This additional electrode 
is needed for high spark rate. Resistor R4 is provided as a discharge path for 
the stored energy in the event that the spark discharge at the igniter plug 
becomes quenched at high pressures. 

A spark monitor circuit connects to ECU terminals C and D. The high 
tension ii te from T2 to the igniter plug is fed through toroidal coil P3. Each 
spark discharge induces a current pulse in the winding of P3. The current 
from each pulse flows through feed-through capacitor C9, resistor R7, pickup 
winding on T3, diode D3, resistor R6, and feed-through capacitor C8. 

Resistor R5 provides a constant load across the windings. Resistors R7 and 
R6 and feed-through capacitors C9 and C8 provide an RF1 filter for the lines to 
the ECU. 

2. Design Requirements 

The basic electrical requirements for the space shuttle main engine 
ignition systems are as follows: 

• Input Voltage to the Exciter - 90 to 130 vac 

• Input Frequency - 350 to 440 Hz 

• Spark Energy - 45 millijoules minimum/spark 


• Spark Repetition Rate - 100 sparks/sec minimum 

• Electromagnetic Interference - MIL-STD-461A 

• Operating Cycle - 5 sec maximum ON, 120 sec minimum OFF 

• The igniter plug tip will be exposed to the following 
environment: 

Plug tip temperature - 37 to 2104°R 

Plug tip pressure - 1 to 50 psia (firing) 

0 to 6000 psia (not firing). 

The ignition exciter shall be pressurized and the maximum air leakage 
shall be 1 x 10 cc/ sec of helium when tested on a mass spectrometer. No 
measurable leakage from the igniter plug into the exciter will be permitted at 
any engine operating condition. 

The ignition system should be capable of operating without degradation 
after withstanding space vacuum for a period of 30 days. The ignition system 
must withstand acceleration loads of 10 g during electrical operation. The 
ignition exciter shall be designed for a minimum verification proof pressure 
of 1. 2 times limit pressure at maximum ambient temperature and a burst 
pressure of 1.5 times limit pressure at maximum ambient temperature. The 
limit pressure is the maximum operating pressure, included EPL and effects 
of system environment such as vehicle acceleration and pressure transients. 

3. Capability 


The 10-392480-1 ignition system is specifically designed for use on the 
Space Shuttle Main Engine. It will meet all environmental, physical, and 
mechanical requirements specified. 

The stored energy of this exciter is 0.189 to 0.278 joules using a 
nominal 3K spark gao. This will provide a spa< k energy at the igniter plug 
electrodes of 0.045 to 0.067 joules/spark, using an estimated 24% discharge 
efficiency. The spark repetition rate for this exciter operating over its full 
voltage range of 90 to 130 vac will be from 100-160 sparks per second. 

The use ot carbon steel housing for the exciter and the RFI filters 
planned for this exciter have proven to be satisfactory in meeting the 
requirements of MIL-STD-461A for higher energy exciters. 

The exciter is designed to meet the intermittent duty operational cycle 
of 5 seconds on, 120 seconds off at its maximum operating temperature of 
140°F. 

4. Substantiation 

The electrical design approach for the ignition system is based on 
experience in many similar applications. Similar high spark rate capacitor 
discharge exciters and igniter plugs have been made for several applications. 
The design parameters for this specific application are substantiated by 
calculations provided in the Avionics Trade Studies, PVVA FR-4439. 
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The storage capacitors are rated at 2500 volts each and will be tested 
at 140 percent of rated voltage. The design subjects them to less than 1700 
volts during discharge. The spark gap will be set for a discharge voltage 
breakdown of 3000 to 3100 volts. The gap design has been very satisfactory 
and has accumulated several hundred hours of operation in other applications. 


The igniter plug design for this application provides a double seal. 
These seals and basic electrode configuration have been used in many 
applications requiring breakdown voltages up to 20 Kv. The glass seal 
^°sign has been verified in electrical connectors rated at -200 to +200°C. 
The plug tip temperatures in this application are higher than normal, but 
due to the required maximum mission life of 500 seconds this should not be 
a problem. 

The heat transfer from the plug tip to the seal areas in the exciter has 
been calculated. (Refer to the Avonics Trade Studies, PWA FR-4439. ) No 
excessive temperature rise was found for this design. 

The mechanical stresses on the system mounting features and exciter 
were also calculated. These stresses, well within normal design limits for 
the application requirements, are also shown in PWA FR-4439. 


